gdp-wired 0.11.0 → 0.12.1

package/dist/kernel/kernel.js

@@ -332,6 +332,9 @@ export function facts(c, path, positive = true) {
 }
 // What a leaf's derivation must refute.
 export function leafConstraints(goal, path) { return leafRows(goal, path, h => facts(h, path)); }
+// The same rows, for the prover's search: each hypothesis' facts as they were at an earlier path of the goal's where
+// every decision they read was the same (facts read the path only through those decisions), and found afresh, with
+// what they read recorded, otherwise. The kernel's check never uses it: it rebuilds every row as leafConstraints does.
 const factsSeen = new WeakMap();
 export function leafConstraintsReusing(goal, path) {
     let byHyp = factsSeen.get(goal);
@@ -340,26 +343,56 @@ export function leafConstraintsReusing(goal, path) {
     return leafRows(goal, path, h => {
         let seen = byHyp.get(h);
         if (!seen)
-            byHyp.set(h, (seen = []));
+            byHyp.set(h, (seen = {}));
         return reusing(seen, path, p => facts(h, p));
     });
 }
+// Past `reuseKeep` values a trie starts afresh: a long search would otherwise keep every value it ever found.
+const reuseKeep = 16;
+function remember(seen, reads, out) {
+    if ((seen.size = (seen.size ?? 0) + 1) > reuseKeep) {
+        seen.root = undefined;
+        seen.size = 1;
+    }
+    const leaf = { reads, out };
+    let node = seen.root, parent, via;
+    while (node && 'key' in node) {
+        // A value that read otherwise than the trie says (none does: the decisions are deterministic) is not kept.
+        if (reads[node.at]?.[0] !== node.key)
+            return;
+        parent = node;
+        via = reads[node.at][1];
+        node = node.next.get(via);
+    }
+    const put = (n) => { if (parent)
+        parent.next.set(via, n);
+    else
+        seen.root = n; };
+    if (!node) {
+        put(leaf);
+        return;
+    }
+    const i = node.reads.findIndex((d, j) => reads[j]?.[0] !== d[0] || reads[j][1] !== d[1]);
+    if (i < 0 || reads[i]?.[0] !== node.reads[i][0])
+        return;
+    put({ at: i, key: node.reads[i][0], next: new Map([[node.reads[i][1], node], [reads[i][1], leaf]]) });
+}
 export function reusing(seen, path, f) {
-    const hit = seen.find(e => e.reads.every(([key, holds]) => path.get(key)?.holds === holds));
-    if (hit) {
+    let node = seen.root;
+    while (node && 'key' in node)
+        node = node.next.get(path.get(node.key)?.holds);
+    if (node && node.reads.every(([key, holds]) => path.get(key)?.holds === holds)) {
         if (recording)
-            for (const [key, holds] of hit.reads)
+            for (const [key, holds] of node.reads)
                 recording.set(key, holds);
-        return hit.out;
+        return node.out;
     }
     const outer = recording, mode = reuse;
     recording = new Map();
     reuse = true;
     try {
         const out = f(new Map(path));
-        seen.unshift({ reads: [...recording], out });
-        if (seen.length > 16)
-            seen.pop();
+        remember(seen, [...recording], out);
         return out;
     }
     finally {
@@ -377,12 +410,12 @@ export function reusing(seen, path, f) {
 let reuse = false;
 const linearSeen = new WeakMap(), comparisonSeen = new WeakMap(), truthSeen = new WeakMap();
 const seenOf = (m, k) => { let s = m.get(k); if (!s)
-    m.set(k, (s = [])); return s; };
+    m.set(k, (s = {})); return s; };
 function leafRows(goal, path, factsOf) {
-    const rows = [...path.values()].map(a => atomOf(a.lin, a.holds));
-    for (const h of goal.hyps)
+    const rows = [...path.values()].map((a, i) => ({ ...atomOf(a.lin, a.holds), src: { atom: i } }));
+    for (const [i, h] of goal.hyps.entries())
         for (const lin of factsOf(h))
-            rows.push({ lin, label: '' });
+            rows.push({ lin, label: '', src: { fact: i } });
     const names = new Set(rows.flatMap(r => Object.keys(r.lin).filter(key => key !== '1')));
     // Two reads of one map whose keys the path proves equal are equal.
     const cells = [...names].filter(name => name.includes('[')).map(name => ({ name, map: name.slice(0, name.indexOf('[')), key: keyOf(name) }));
@@ -392,7 +425,7 @@ function leafRows(goal, path, factsOf) {
                 continue;
             const d = sub(p.key, q.key);
             if (decide(d, path) === true && decide(scale(d, -1), path) === true)
-                rows.push({ lin: sub(v(p.name), v(q.name)), label: '' }, { lin: sub(v(q.name), v(p.name)), label: '' });
+                rows.push({ lin: sub(v(p.name), v(q.name)), label: '', src: { pair: [p.name, q.name] } }, { lin: sub(v(q.name), v(p.name)), label: '', src: { pair: [p.name, q.name] } });
         }
     // Each term column's rows, and the columns those rows bring in turn.
     const seen = new Set(), todo = [...names].filter(n => n.startsWith('⟦'));
@@ -402,7 +435,7 @@ function leafRows(goal, path, factsOf) {
             continue;
         seen.add(name);
         for (const lin of termRows(name, path)) {
-            rows.push({ lin, label: '' });
+            rows.push({ lin, label: '', src: { term: name } });
             for (const key of Object.keys(lin))
                 if (key !== '1') {
                     names.add(key);
@@ -412,7 +445,7 @@ function leafRows(goal, path, factsOf) {
         }
     }
     for (const name of names)
-        rows.push({ lin: { [name]: -1 }, label: '' });
+        rows.push({ lin: { [name]: -1 }, label: '', src: { nat: name } });
     return rows;
 }
 const keyOf = (cell) => {
@@ -504,8 +537,8 @@ export function substC(c, s) {
     if (c.op === 'not')
         return { op: 'not', x: substC(c.x, s) };
     if (c.op === 'all') {
-        const { [c.key]: _bound, ...vars } = s.vars;
-        return { op: 'all', key: c.key, c: substC(c.c, { ...s, vars }) };
+        const keys = boundOf(c), vars = Object.fromEntries(Object.entries(s.vars).filter(([n]) => !keys.includes(n)));
+        return { ...c, c: substC(c.c, { ...s, vars }) };
     }
     if (c.op === 'and' || c.op === 'or')
         return { op: c.op, xs: c.xs.map(y => substC(y, s)) };
@@ -567,6 +600,29 @@ const flagsOf = (m) => {
     return out;
 };
 const quantified = (m) => Object.entries(m.step.flags ?? {}).filter((e) => e[1].op === 'all');
+// The keys a quantifier binds: its key, and a quantified flag's further keys (a condition at every tuple of keys).
+export const boundOf = (c) => [c.key, ...(c.keys ?? [])];
+// A quantified flag's witnesses, one per key: w?f, then w2?f, w3?f.
+export const witnessesOf = (f, q) => boundOf(q).map((_, i) => (i ? `w${i + 1}?${f}` : `w?${f}`));
+// A comparison between two of a flag's keys, plainly (i < j, i ≤ j, i = j).
+const crossing = (c, keys) => (c.op === '<' || c.op === '<=' || c.op === '=') && c.a.op === 'var' && c.b.op === 'var' && c.a.name !== c.b.name && keys.includes(c.a.name) && keys.includes(c.b.name);
+// A condition over several keys with each comparison between two of them set aside (as 0 ≤ 0): what reads each key on
+// its own. (Kept per condition and keys: the runtimes ask at every step.)
+const crossCache = new WeakMap();
+export const crossFree = (c, keys) => {
+    const id = keys.join(','), hit = crossCache.get(c)?.get(id);
+    if (hit)
+        return hit;
+    const zero = { op: 'const', value: 0 };
+    const e = (t) => (t.op === 'if' ? { ...t, c: crossFree(t.c, keys), then: e(t.then), else: e(t.else) } : t.op === 'get' ? { ...t, key: e(t.key) } : t.op === 'mul' ? { ...t, a: e(t.a) }
+        : t.op === 'add' || t.op === 'sub' || t.op === 'min' || t.op === 'max' || t.op === 'prod' ? { ...t, a: e(t.a), b: e(t.b) } : t);
+    const out = crossing(c, keys) ? { op: '<=', a: zero, b: zero } : c.op === 'not' ? { op: 'not', x: crossFree(c.x, keys) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(y => crossFree(y, keys)) }
+        : c.op === 'all' ? { ...c, c: crossFree(c.c, keys) } : c.op === 'flag' ? c : { ...c, a: e(c.a), b: e(c.b) };
+    if (!crossCache.has(c))
+        crossCache.set(c, new Map());
+    crossCache.get(c).set(id, out);
+    return out;
+};
 // A machine's step as an update, its flags inlined.
 const updateOf = (m) => {
     const flags = { vars: {}, maps: {}, flags: flagsOf(m) };
@@ -579,15 +635,17 @@ const inlineFlags = (m, c) => substC(c, { vars: {}, maps: {}, flags: flagsOf(m)
 // A quantified flag ?f, closed: it is 0 or 1; where it is 1, its condition holds at each key the proof names (instances
 // under ?f); where it is 0, the condition fails at a fresh witness w?f. A real step decides ?f by the condition, and if
 // that fails some key fails it, so these hold of every real step: a goal that refutes them refutes the machine.
+// Over several keys, the instances are tuples (flattened, as Instances keeps them) and there is a witness per key.
 const closing = (m, instances) => quantified(m).flatMap(([f, q]) => {
-    const v = { op: 'var', name: `?${f}` }, zero = { op: 'const', value: 0 }, one = { op: 'const', value: 1 };
-    const body = (key) => substC(q.c, { vars: { [q.key]: key }, maps: {}, flags: flagsOf(m) });
-    return [{ op: '<=', a: v, b: one }, ...(instances[`?${f}`] ?? []).map((key) => ({ op: 'or', xs: [{ op: '=', a: v, b: zero }, body(key)] })),
-        { op: 'or', xs: [{ op: '=', a: v, b: one }, { op: 'not', x: body({ op: 'var', name: `w?${f}` }) }] }];
+    const v = { op: 'var', name: `?${f}` }, zero = { op: 'const', value: 0 }, one = { op: 'const', value: 1 }, names = boundOf(q), n = names.length;
+    const body = (keys) => substC(q.c, { vars: Object.fromEntries(names.map((key, i) => [key, keys[i]])), maps: {}, flags: flagsOf(m) });
+    const inst = instances[`?${f}`] ?? [];
+    return [{ op: '<=', a: v, b: one }, ...Array.from({ length: Math.floor(inst.length / n) }, (_, t) => ({ op: 'or', xs: [{ op: '=', a: v, b: zero }, body(inst.slice(t * n, (t + 1) * n))] })),
+        { op: 'or', xs: [{ op: '=', a: v, b: one }, { op: 'not', x: body(witnessesOf(f, q).map((name) => ({ op: 'var', name }))) }] }];
 });
 // The names a later step (j >= 2) reads its request by: inputs, quantified flags and their witnesses, and carried maps.
 const laterNames = (m, j) => ({
-    vars: Object.fromEntries([...m.inputs, ...quantified(m).flatMap(([f]) => [`?${f}`, `w?${f}`])].map(name => [name, { op: 'var', name: `${name}@${j}` }])),
+    vars: Object.fromEntries([...m.inputs, ...quantified(m).flatMap(([f, q]) => [`?${f}`, ...witnessesOf(f, q)])].map(name => [name, { op: 'var', name: `${name}@${j}` }])),
     maps: Object.fromEntries((m.inputMaps ?? []).map(map => [map, `${map}@${j}`])),
 });
 // The laws assumed where the run is: each plain law, and each every-key law at the keys the proof names.
@@ -619,7 +677,8 @@ function reads(t, out = { vars: new Set(), maps: new Set(), flags: new Set() })
             break;
         case 'all': {
             const inner = reads(t.c);
-            inner.vars.delete(t.key);
+            for (const key of boundOf(t))
+                inner.vars.delete(key);
             for (const k of ['vars', 'maps', 'flags'])
                 for (const name of inner[k])
                     out[k].add(name);
@@ -709,9 +768,14 @@ export function scope(m, laws = []) {
         const c = m.step.flags[f], what = `${m.name}'s flag ${f}`;
         // A quantified flag's body reads no flag (the twin decides quantified flags before the plain ones).
         if (c.op === 'all') {
-            bound(what, c.key, c.c);
+            const keys = boundOf(c), body = crossFree(c.c, keys);
+            distinct(what, keys);
+            for (const key of keys) {
+                bound(what, key, body);
+                apart(what, body, key, keys);
+            }
             unquantified(what, c.c);
-            inScope(what, [c.c], [...names, c.key], readable, []);
+            inScope(what, [c.c], [...names, ...keys], readable, []);
         }
         else {
             unquantified(what, c);
@@ -825,6 +889,20 @@ function keyOnly(what, t, key, fns = []) {
     };
     walk(t);
 }
+// Over several keys, each read apart from the others: no offset of its key terms, and no value it is compared with, reads
+// another (the comparisons between two of them, plainly, are set aside before: crossFree).
+function apart(what, t, key, keys) {
+    const others = keys.filter(k => k !== key), other = (e) => others.some(k => readsKey(e, k));
+    const walk = (u) => {
+        if ((u.op === 'get' && keyTerm(u.key, key) && other(u.key))
+            || ((u.op === '<' || u.op === '<=' || u.op === '=') && ((keyTerm(u.a, key) && (other(u.a) || other(u.b))) || (keyTerm(u.b, key) && (other(u.a) || other(u.b))))))
+            throw new Error(`${what}: the keys ${keys.join(', ')} are each read on their own, and compared with one another only plainly (i < j, i <= j, i = j)`);
+        for (const x of Object.values(u))
+            if (x && typeof x === 'object')
+                (Array.isArray(x) ? x : [x]).forEach(y => walk(y));
+    };
+    walk(t);
+}
 // Whether the key is read only as a map's key, plainly (what the GPU searches decide: every cell, and one past them).
 export const plainKey = (t, key) => {
     const walk = (u) => {
@@ -1042,7 +1120,7 @@ export function stepLawObligations(machine, laws, instances, sl) {
     const m = machine.history ? historyMachine(machine).machine : machine;
     scope(m, laws);
     const k = sl.steps ?? 1;
-    // Past 64 the cost is the bound (proving grows about as k³: 64 steps in about 90 s; Lean checks 32 in about 13 minutes).
+    // Past 64 the cost is the bound (proving grows about as k³: 64 steps in about 17 s on Modal; Lean checks 32 in about 25 s, 64 in about 3 minutes).
     if (!Number.isInteger(k) || k < 1 || k > 64)
         throw new Error(`step law ${sl.name}: steps is a whole number from 1 to 64`);
     const whens = sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when];

package/dist/kernel/prove.js

@@ -1,5 +1,5 @@
 import { add, k, refuteFast, scale, solve, sub, v } from "../core/solver.js";
-import { assumed, canon, canonFlip, columnTerm, decided, stepZone, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, leafConstraintsReusing, reusing, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
+import { assumed, boundOf, canon, canonFlip, columnTerm, decided, stepZone, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, leafConstraintsReusing, reusing, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, witnessesOf, withProducts } from "./kernel.js";
 // The atoms the path leaves open, in evaluation order: deciding any of them makes progress.
 function openE(e, path, out) {
     switch (e.op) {
@@ -183,11 +183,17 @@ function growPlain(goal, path, budget) {
     if (!byHyp)
         openSeen.set(goal, (byHyp = new Map()));
     const openOf = (h) => { let seen = byHyp.get(h); if (!seen)
-        byHyp.set(h, (seen = [])); return reusing(seen, path, p => { const out = []; openH(h, p, out); return out; }); };
+        byHyp.set(h, (seen = {})); return reusing(seen, path, p => { const out = []; openH(h, p, out); return out; }); };
+    // Then the hypotheses about only the names the conclusion reads (an assumption about another key, a witness, can
+    // wait: a refutation seldom needs it), then the rest, each group in the goal's order.
     if (last >= 0)
         open.push(...openOf(hyps[last]));
+    const near = nearOf(goal);
     for (const [i, h] of hyps.entries())
-        if (i !== last)
+        if (i !== last && near[i])
+            open.push(...openOf(h));
+    for (const [i, h] of hyps.entries())
+        if (i !== last && !near[i])
             open.push(...openOf(h));
     open.push(...openCells(rows, path));
     const next = open.find(lin => Object.keys(lin).some(key => key !== '1') && !path.has(canon(lin)) && !path.has(canonFlip(lin)));
@@ -204,6 +210,13 @@ function growPlain(goal, path, budget) {
     const verdict = next && rows.length > 60 ? solveP(rows, 2 * rows.length) : solveP(rows);
     if (verdict.kind === 'refuted')
         return { tree: leafOf(verdict.steps), nodes: budget.nodes };
+    // Before a split, the rows the plain search sets aside (those reading a term column) by their Farkas rows: an open
+    // choice's bounds (min(a, c) ≤ c) often refute the case whichever way the choice goes, so its cases need no split.
+    if (next && !columns && full.length > rows.length) {
+        const fast = timed(() => refuteFast(full), ms => { profile.solves++; profile.solveMs += ms; });
+        if (fast?.kind === 'refuted')
+            return { tree: { leaf: fast.steps }, nodes: budget.nodes };
+    }
     let split = next ?? (verdict.kind === 'unknown' ? bisect(rows, path) ?? fractional(verdict.point, path) : undefined);
     // Products: with monomials about, try every pair of rows multiplied; failing that, split a factor at zero.
     const monomials = rows.some(r => Object.keys(r.lin).some(key => key.includes('*')));
@@ -308,6 +321,17 @@ function lift(goal, tree, from, to) {
     };
     return go(tree, from, to);
 }
+// Whether each hypothesis reads only names the goal's conclusion (its last hypothesis) reads.
+const nearSeen = new WeakMap();
+const namesOf = (t) => (t === undefined ? [] : [...JSON.stringify(t).matchAll(/"(?:name|map)":"([^"]+)"/g)].map(m => m[1]));
+function nearOf(goal) {
+    let out = nearSeen.get(goal);
+    if (!out) {
+        const theirs = new Set(namesOf(goal.hyps.at(-1)));
+        nearSeen.set(goal, (out = goal.hyps.map(h => namesOf(h).every(n => theirs.has(n)))));
+    }
+    return out;
+}
 // Each hypothesis' open atoms, as at an earlier path that decided the same atoms it reads (kernel.ts's reusing).
 const openSeen = new WeakMap();
 // What ran out, for a goal left unknown: its size, how deep the case splits went, and the two shapes that usually cause it.
@@ -446,7 +470,7 @@ function fractional(point, path) {
 // A key bound by a quantified flag or a write at every key isn't one: those reads are at every key already.
 function readKeys(m, laws) {
     const out = new Map();
-    const bound = new Set([...Object.values(m.step.flags ?? {}).flatMap(c => (c.op === 'all' ? [c.key] : [])), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : []))]);
+    const bound = new Set([...Object.values(m.step.flags ?? {}).flatMap(c => (c.op === 'all' ? boundOf(c) : [])), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : []))]);
     const free = (e) => !JSON.stringify(e).match(/"name":"([^"]+)"/g)?.some(n => bound.has(n.slice(8, -1)));
     const inE = (e) => {
         if (e.op === 'get') {
@@ -503,30 +527,35 @@ function mapKeys(goals) {
 const withReads = (laws, inst, keys, focus) => ({ ...inst, ...Object.fromEntries(laws.filter(l => l.forall).map(l => {
         const had = inst[l.name] ?? [];
         if (l.keys?.length) {
-            const n = l.keys.length + 1;
-            const reads = (e, x) => x !== undefined && JSON.stringify(e).includes(`"name":${JSON.stringify(x)}`);
-            const own = (i) => { const f = focus[i] ?? focus[0]; return keys.filter(e => reads(e, f) && focus.every(g => g === f || !reads(e, g))); };
-            const R = keys.filter(e => !focus.some(f => reads(e, f)));
-            const out = new Map();
+            const n = l.keys.length + 1, out = new Map();
             for (let i = 0; i + n <= had.length; i += n)
                 out.set(JSON.stringify(had.slice(i, i + n)), had.slice(i, i + n));
-            const go = (i, tuple, rest) => {
-                if (i === n) {
-                    out.set(JSON.stringify(tuple), tuple);
-                    return;
-                }
-                for (const e of own(i))
-                    go(i + 1, [...tuple, e], rest);
-                if (!rest)
-                    for (const e of R)
-                        go(i + 1, [...tuple, e], true);
-            };
-            go(0, [], false);
+            for (const tuple of related(keys, focus, n))
+                out.set(JSON.stringify(tuple), tuple);
             return [l.name, [...out.values()].flat()];
         }
         const seen = new Set(had.map(e => JSON.stringify(e)));
         return [l.name, [...had, ...keys.filter(e => { const id = JSON.stringify(e); return seen.has(id) ? false : (seen.add(id), true); })]];
     })) });
+// The n-tuples of the keys that relate the focus (withReads).
+const related = (keys, focus, n) => {
+    const reads = (e, x) => x !== undefined && JSON.stringify(e).includes(`"name":${JSON.stringify(x)}`);
+    const own = (i) => { const f = focus[i] ?? focus[0]; return keys.filter(e => reads(e, f) && focus.every(g => g === f || !reads(e, g))); };
+    const R = keys.filter(e => !focus.some(f => reads(e, f))), out = [];
+    const go = (i, tuple, rest) => {
+        if (i === n) {
+            out.push(tuple);
+            return;
+        }
+        for (const e of own(i))
+            go(i + 1, [...tuple, e], rest);
+        if (!rest)
+            for (const e of R)
+                go(i + 1, [...tuple, e], true);
+    };
+    go(0, [], false);
+    return out;
+};
 // A law about every n keys at every n-tuple of the keys (flattened, as Instances keeps tuples).
 const tuples = (keys, n) => (n === 0 ? [] : n === 1 ? keys : keys.flatMap(a => { const rest = tuples(keys, n - 1); return Array.from({ length: rest.length / (n - 1) }, (_, t) => [a, ...rest.slice(t * (n - 1), (t + 1) * (n - 1))]).flat(); }));
 // The keys some goals read a function at.
@@ -615,43 +644,56 @@ function match(pattern, term, x) {
     };
     return go(pattern, term) ? bound : undefined;
 }
-// Each quantified flag's witness w?f: a key where its condition fails, when it does; every-key facts are wanted there too.
-const witnesses = (m) => Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [{ op: 'var', name: `w?${f}` }] : []));
-// The keys each quantified flag is assumed at (instances under ?f).
-const flagInstances = (m, keys) => Object.fromEntries(Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [[`?${f}`, keys]] : [])));
+// Each quantified flag's witness w?f (one per key, over several): a key where its condition fails, when it does;
+// every-key facts are wanted there too.
+const witnesses = (m) => Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? witnessesOf(f, c).map((name) => ({ op: 'var', name })) : []));
+// The keys each quantified flag is assumed at (instances under ?f): over several keys, the tuples that relate the
+// goals' own keys as a law about several keys takes them (every tuple, without them).
+const flagInstances = (m, keys, focus = []) => Object.fromEntries(Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => {
+    if (c.op !== 'all')
+        return [];
+    const n = boundOf(c).length;
+    return [[`?${f}`, n === 1 ? keys : focus.length ? related(keys, focus, n).flat() : tuples(keys, n)]];
+}));
+const pairFlags = (m) => Object.values(m.step.flags ?? {}).some(c => c.op === 'all' && !!c.keys?.length);
+// How many keys each instance of a name takes: a law's, or a quantified flag's (?f).
+const arity = (m, laws, n) => {
+    const q = n.startsWith('?') ? m?.step.flags?.[n.slice(1)] : undefined;
+    return q?.op === 'all' ? boundOf(q).length : (laws.find(l => l.name === n)?.keys?.length ?? 0) + 1;
+};
 // The instances some goals need, for every entry point: the every-key laws and the quantified flags at `seed` (the keys
 // the step and the laws read, when known before any goal is built), then twice round: the facts at every key the goals
 // built so far read a function at, and, where the seed doesn't cover them (no seed, positions that shift, a law about
 // several keys), the every-key laws and flags at every key they read a map at (a law about several keys at tuples
 // relating `focus`, the goals' own keys).
 function instancesFor(m, laws, build, opts = {}) {
-    let inst = opts.start ?? (opts.seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : opts.seed])), ...flagInstances(m, opts.seed) } : {});
-    const reads = opts.reads ?? (!opts.seed || shifts(m) || laws.some(l => l.keys?.length));
+    let inst = opts.start ?? (opts.seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : opts.seed])), ...flagInstances(m, opts.seed, opts.focus) } : {});
+    const reads = opts.reads ?? (!opts.seed || shifts(m) || laws.some(l => l.keys?.length) || pairFlags(m));
     for (let round = 0; round < 2; round++) {
         if (m.facts?.length)
             inst = withFacts(m, inst, fnKeys(m, build(inst)));
         if (reads) {
             const keys = mapKeys(build(inst));
-            inst = union(withReads(laws, inst, keys, opts.focus ?? []), flagInstances(m, keys));
+            inst = union(withReads(laws, inst, keys, opts.focus ?? []), flagInstances(m, keys, opts.focus), m);
         }
     }
     return inst;
 }
 // Instances without the keys that read any of these names (a law about several keys loses each tuple that does).
-const avoiding = (inst, names, laws) => {
+const avoiding = (inst, names, laws, m) => {
     const bad = (e) => names.some(n => JSON.stringify(e).includes(`"name":${JSON.stringify(n)}`));
     return Object.fromEntries(Object.entries(inst).map(([n, keys]) => {
-        const arity = (laws.find(l => l.name === n)?.keys?.length ?? 0) + 1;
-        const tuples = Array.from({ length: Math.floor(keys.length / arity) }, (_, t) => keys.slice(t * arity, (t + 1) * arity));
-        return [n, tuples.filter(tuple => !tuple.some(bad)).flat()];
+        const a = arity(m, laws, n), groups = Array.from({ length: Math.floor(keys.length / a) }, (_, t) => keys.slice(t * a, (t + 1) * a));
+        return [n, groups.filter(tuple => !tuple.some(bad)).flat()];
     }));
 };
-// Two sets of instances together: each name at the keys of both.
-const union = (a, b) => {
+// Two sets of instances together: each name at the keys (or tuples) of both.
+const union = (a, b, m) => {
     const out = { ...a };
     for (const [n, keys] of Object.entries(b)) {
-        const seen = new Set((out[n] ?? []).map(e => JSON.stringify(e)));
-        out[n] = [...(out[n] ?? []), ...keys.filter(e => !seen.has(JSON.stringify(e)))];
+        const k = arity(m, [], n), groups = (ks) => Array.from({ length: Math.floor(ks.length / k) }, (_, t) => ks.slice(t * k, (t + 1) * k));
+        const seen = new Set(groups(out[n] ?? []).map(g => JSON.stringify(g)));
+        out[n] = [...(out[n] ?? []), ...groups(keys).filter(g => !seen.has(JSON.stringify(g))).flat()];
     }
     return out;
 };
@@ -763,12 +805,12 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     // law's later frames read keys no other step law has); where positions shift or a law is about several keys, the
     // keys its goal reads a map at too. A frame's hypotheses read no name the run introduces later (kernel.ts's
     // stepZone), so a k-step law drops the keys that read one.
-    const shared = [...readKeys(plain, laws), ...witnesses(plain)], named = [...laws, ...(plain.facts ?? [])], reads = shifts(plain) || laws.some(l => l.keys?.length);
+    const shared = [...readKeys(plain, laws), ...witnesses(plain)], named = [...laws, ...(plain.facts ?? [])], reads = shifts(plain) || laws.some(l => l.keys?.length) || pairFlags(plain);
     const own = (sl) => [...[sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC),
         ...[sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : []))];
     const perStep = {};
     for (const sl of stepLaws) {
-        const zone = stepZone(plain, sl.steps ?? 1), keep = (inst) => avoiding(inst, zone, named);
+        const zone = stepZone(plain, sl.steps ?? 1), keep = (inst) => avoiding(inst, zone, named, plain);
         perStep[sl.name] = keep(instancesFor(plain, laws, inst => stepLawObligations(m, laws, keep(inst), sl), { seed: [...shared, ...own(sl)], focus: [sl.forall, ...(sl.keys ?? [])].flatMap(k => (k ? [k] : [])), reads }));
     }
     const instances = perStep[stepLaws[0]?.name ?? ''] ?? {};

package/dist/lean-kernel/emit.js

@@ -1,6 +1,6 @@
 import { atMost, n, not, pointWrite } from "../core/machine.js";
 import { add, k, scale, sub } from "../core/solver.js";
-import { canon, columnTerm, stateName, termColumn, historyMachine, foldObligations, leafConstraints, loopLiveness, loopMachine, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, withProducts } from "../kernel/kernel.js";
+import { boundOf, canon, columnTerm, stateName, termColumn, historyMachine, foldObligations, leafConstraints, loopLiveness, loopMachine, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, witnessesOf, withProducts } from "../kernel/kernel.js";
 import { grow, proveBuilt, proveLaws, proveStepLaws } from "../kernel/prove.js";
 import { refinement, refinementSides } from "../core/compose.js";
 import { leanSurface, leanTerms } from "./lean-terms.js";
@@ -137,7 +137,9 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
             coefs.pop();
         return coefs;
     };
-    const row = (lin) => `⟨${list(dense(lin).map(int))}, ${int(lin['1'] ?? 0)}⟩`;
+    // Rows by their nonzero coefficients (Cert.lean's rows hold them so): most of a wide row is zeros.
+    const sparse = (coefs) => list(coefs.flatMap((x, j) => (x === 0 ? [] : [`(${j}, ${int(x)})`])));
+    const row = (lin) => `(sp ${sparse(dense(lin))} ${int(lin['1'] ?? 0)})`;
     const { e, c } = leanTerms(vars, maps, ex.name);
     const tab = cols.map(name => (name.includes('[') ? `.cell ${maps.indexOf(cellMap(name))} ${row(cellKey(name))}`
         : name.startsWith('⟦') ? `.term (${e(columnTerm(name))})`
@@ -171,22 +173,35 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
             const q = Object.fromEntries(Object.entries(from).filter(([key]) => key !== '1').map(([key, v]) => [key, v / s.g]));
             const cc = Math.ceil((from['1'] ?? 0) / s.g);
             replay.push({ ...q, 1: cc });
-            return `.cut ${s.of} ${int(s.g)} ${list(dense(q).map(int))} ${int(cc)}`;
+            return `.cut ${s.of} ${int(s.g)} ${sparse(dense(q))} ${int(cc)}`;
         });
         if (tamper && dropStep && leafNo++ === 0)
             steps = steps.slice(0, -1); // the first leaf loses its last step
         // Cell pairs the path proves equal (Lean re-checks each).
-        const eqs = [];
+        const eqs = [], pairs = [];
         const cellCols = cols.map((name, j) => ({ name, j })).filter(c2 => c2.name.includes('['));
         for (const [a, p] of cellCols.entries())
             for (const q of cellCols.slice(a + 1)) {
                 if (cellMap(p.name) !== cellMap(q.name))
                     continue;
                 const d = sub(cellKey(p.name), cellKey(q.name));
-                if (decide(d, path) === true && decide(scale(d, -1), path) === true)
+                if (decide(d, path) === true && decide(scale(d, -1), path) === true) {
                     eqs.push(`(${p.j}, ${q.j})`);
+                    pairs.push([p.name, q.name].sort().join('\n'));
+                }
             }
-        return `.leaf ${list(used.map(u => row(rows[u])))} ${list(steps)} ${list(eqs)} ${list(prods.map(([i, j]) => `(${idx(i)}, ${idx(j)})`))}`;
+        // Each row with where Lean finds it (a hint: missed, Lean looks among all of the leaf's rows).
+        const hint = (src) => {
+            if (!src)
+                return '.any';
+            if ('atom' in src)
+                return `.atom ${path.size - 1 - src.atom}`; // Lean's path has the latest decision first
+            if ('fact' in src)
+                return `.fact ${src.fact}`;
+            const j = 'pair' in src ? pairs.indexOf([...src.pair].sort().join('\n')) : col.get('nat' in src ? src.nat : src.term) ?? -1;
+            return j < 0 ? '.any' : 'pair' in src ? `.eq ${j}` : 'nat' in src ? `.nat ${j}` : `.term ${j}`;
+        };
+        return `.leafAt ${list(used.map(u => `(${row(rows[u])}, ${hint(base[u].src)})`))} ${list(steps)} ${list(eqs)} ${list(prods.map(([i, j]) => `(${idx(i)}, ${idx(j)})`))}`;
     };
     return { tab: list(tab), hyps: list(goal.hyps.map(c)), tree: lean(tree, new Map()), cols, c, e };
 }
@@ -474,7 +489,7 @@ const flagsOfM = (m) => {
 // Sets, or functions with facts: both go through Sets.lean.
 export const hasSets = (m) => !!m.inputMaps?.length || Object.values(m.step.flags ?? {}).some(c => c.op === 'all') || Object.values(m.step.maps ?? {}).some(w => 'each' in w)
     || !!Object.keys(m.fns ?? {}).length || !!m.facts?.length;
-const boundKeys = (m) => [...Object.values(m.step.flags ?? {}).flatMap(c => (c.op === 'all' ? [c.key] : [])), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : []))];
+const boundKeys = (m) => [...Object.values(m.step.flags ?? {}).flatMap(c => (c.op === 'all' ? boundOf(c) : [])), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : []))];
 // A machine with a history goes as its plain machine (kernel.ts's historyMachine: sums as state, queries as inputs,
 // the relations assumed), built in Lean from the machine and its history (History.lean's HMachine.plain), so every claim
 // below is about it; with the relations' record goals, its laws hold over histories too (hmachine_sound).
@@ -505,7 +520,7 @@ def ${id}_step${j} : SKStep := ⟨⟨${list(Array.from({ length: kk }, (_, s2) =
   ${list(finsts(inst))},
   ${list(pinsts(inst))},
   ${list(pfinsts(inst))},
-  [],
+  ${pr.hyps},
   ${list(Array.from({ length: kk - 1 }, (_, s2) => list(Object.keys(m.state).map(n2 => `(${ix(n2)}, ${ix(stateName(n2, s2 + 1))})`))))}⟩
 theorem ${id}_step${j}_holds : SKStepHolds ${id}_machine ${id}_step${j} :=
   skstep_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by decide +kernel)`;
@@ -580,9 +595,10 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
         throw new Error(`${id}: not proven`);
     const lp = r.proof.laws, si = r.proof.instances;
     const flags = Object.entries(m.step.flags ?? {}), quantified = flags.filter(([, c]) => c.op === 'all').map(([f]) => f);
+    const qwits = (f) => witnessesOf(f, m.step.flags[f]);
     const carried = m.inputMaps ?? [], facts = m.facts ?? [], keysOf = [...new Set([...laws, ...facts].flatMap(l => [l.forall, ...(l.keys ?? [])].filter((k) => !!k)))];
     const k = Math.max(1, ...allSteps.map(sl => sl.steps ?? 1));
-    const ext = [...m.inputs, ...quantified.flatMap(f => [`?${f}`, `w?${f}`])];
+    const ext = [...m.inputs, ...quantified.flatMap(f => [`?${f}`, ...qwits(f)])];
     const later = Array.from({ length: k - 1 }, (_, j) => ext.map(v => `${v}@${j + 2}`)).flat();
     const laterMaps = Array.from({ length: k - 1 }, (_, j) => carried.map(mp => `${mp}@${j + 2}`)).flat();
     const primes = allSteps.length ? Object.keys(m.state).map(s2 => `${s2}'`) : [];
@@ -635,9 +651,14 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
                 return Array.from({ length: Math.floor(keys.length / k) }, (_, t) => sub1(sub1(lw.holds, Object.fromEntries(lw.keys.map((kn, i) => [kn, keys[t * k + 1 + i]]))), { [lw.forall]: keys[t * k] }));
             }),
             w,
-            ...allFlags.flatMap(([f, fc]) => (fc.op === 'all' ? [{ op: '<=', a: { op: 'var', name: `?${f}` }, b: zero1(1) },
-                ...(inst[`?${f}`] ?? []).map((key) => ({ op: 'or', xs: [eqC({ op: 'var', name: `?${f}` }, zero1(0)), sub1(fc.c, { [fc.key]: key })] })),
-                { op: 'or', xs: [eqC({ op: 'var', name: `?${f}` }, zero1(1)), { op: 'not', x: sub1(fc.c, { [fc.key]: { op: 'var', name: `w?${f}` } }) }] }] : []))];
+            ...allFlags.flatMap(([f, fc]) => {
+                if (fc.op !== 'all')
+                    return [];
+                const names = boundOf(fc), n = names.length, at = (ts) => sub1(fc.c, Object.fromEntries(names.map((key, i) => [key, ts[i]]))), qi = inst[`?${f}`] ?? [];
+                return [{ op: '<=', a: { op: 'var', name: `?${f}` }, b: zero1(1) },
+                    ...Array.from({ length: Math.floor(qi.length / n) }, (_, t) => ({ op: 'or', xs: [eqC({ op: 'var', name: `?${f}` }, zero1(0)), at(qi.slice(t * n, (t + 1) * n))] })),
+                    { op: 'or', xs: [eqC({ op: 'var', name: `?${f}` }, zero1(1)), { op: 'not', x: at(qwits(f).map((name) => ({ op: 'var', name }))) }] }];
+            })];
         const last = { op: 'not', x: sInline(m.assume ?? trueC) }, zkeys = carriedKeys([...base, last]);
         return { name: 'allowed', hyps: [...base, ...(m.inputMaps ?? []).flatMap(mp => zkeys.map(t => eqC({ op: 'get', map: mp, key: t }, zero1(0)))), last], zkeys };
     };
@@ -647,7 +668,7 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
         })]));
     const allowGoals = [...allowed.values()].flatMap(a => (a ? [a.out.goal] : []));
     const vars = [...new Set([...m.params, ...m.inputs, ...Object.keys(m.state), ...keysOf, ...keysOf.map(k2 => `${k2}#`), '#', ...flags.map(([f]) => `?${f}`),
-            ...quantified.map(f => `w?${f}`), ...boundKeys(m), ...(opts.tamper ? boundKeys(opts.tamper.machine) : []), ...stepLaws.flatMap(sl => (sl.forall ? [sl.forall] : [])), ...(opts.free ?? []),
+            ...quantified.flatMap(qwits), ...boundKeys(m), ...(opts.tamper ? boundKeys(opts.tamper.machine) : []), ...stepLaws.flatMap(sl => (sl.forall ? [sl.forall] : [])), ...(opts.free ?? []),
             ...primes, ...later, ...Array.from({ length: k - 1 }, (_, j) => Object.keys(m.state).map(n2 => stateName(n2, j + 1))).flat(),
             ...(hm ? hm.history.record.map(f => `r.${f}`) : []), ...[...goalsL, ...goalsS, ...allowGoals, ...(hplain?.goals ?? [])].flatMap(g => g.hyps.flatMap(varsOf))])];
     const baseMaps = [...new Set([...Object.keys(m.maps ?? {}), ...Object.keys(m.step.maps ?? {}), ...Object.keys(m.fns ?? {})])];
@@ -672,8 +693,8 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
   ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [] : [`(${ix(`?${f}`)}, ${c(fl[f])})`])))}⟩,
   ${list((mm.inputMaps ?? []).map(mp => String(mx(mp))))},
   ${list(ws.flatMap(([name, w]) => ('each' in w ? [`(${mx(name)}, ${ix(w.each)}, ${e(w.value)})`] : [])))},
-  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${ix(c2.key)}, ${c(c2.c)})`] : [])))},
-  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${ix(`w?${f}`)})`] : [])))},
+  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${list(boundOf(c2).map(key => String(ix(key))))}, ${c(c2.c)})`] : [])))},
+  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${list(witnessesOf(f, c2).map(w => String(ix(w))))})`] : [])))},
   ${list((mm.facts ?? []).filter(l => !l.keys?.length).map(l => `⟨${c(l.holds)}, ${l.forall ? `some ${ix(l.forall)}` : 'none'}⟩`))},
   ${list((mm.facts ?? []).filter(l => l.keys?.length).map(l => `(⟨${c(l.holds)}, some ${ix(l.forall)}⟩, ${list(l.keys.map(k2 => String(ix(k2))))})`))}⟩`;
     };
@@ -727,20 +748,24 @@ ${readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat
         const n = factsN[j].keys.length + 1;
         return Array.from({ length: Math.floor(keys.length / n) }, (_, t) => `(${j}, ${e(keys[t * n])}, ${list(keys.slice(t * n + 1, t * n + n).map(e))})`);
     });
-    const qinsts = (inst) => Object.entries(inst).filter(([name]) => name.startsWith('?')).flatMap(([f, keys]) => keys.map(key => `(${ix(f)}, ${e(key)})`));
+    // Each quantified flag at its tuples (one key each, over one key).
+    const qinsts = (inst) => Object.entries(inst).filter(([name]) => name.startsWith('?')).flatMap(([f, keys]) => {
+        const q = m.step.flags?.[f.slice(1)], n = q?.op === 'all' ? boundOf(q).length : 1;
+        return Array.from({ length: Math.floor(keys.length / n) }, (_, t) => `(${ix(f)}, ${list(keys.slice(t * n, (t + 1) * n).map(e))})`);
+    });
     const entries = laws.map((law, j) => {
         const g0 = goalsL[2 * j], g1 = goalsL[2 * j + 1], a = enc(g0, lp.trees[g0.name]), b = enc(g1, lp.trees[g1.name]), inst = lp.instances[law.name] ?? {};
         return `def ${id}_l${j} : MLaw := ⟨${c(law.holds)}, ${law.forall ? `some ${ix(law.forall)}` : 'none'}⟩
 def ${id}_e${j} : SEntry := ⟨${id}_l${j}, ${ix(law.forall ? `${law.forall}#` : '#')}, ${list((law.keys ?? []).map(key => String(ix(key))))}, ${list(insts(inst))}, ${list(qinsts(inst))}, ${list(finsts(inst))}, ${list(pinsts(inst))}, ${list(pfinsts(inst))},
-  (${a.tab}, [], ${a.tree}),
-  (${b.tab}, [], ${b.tree})⟩`;
+  (${a.tab}, ${a.hyps}, ${a.tree}),
+  (${b.tab}, ${b.hyps}, ${b.tree})⟩`;
     });
     // A ghosted machine (compose.ts's ghost): the original and its ghosts, the machine Lean checks built from them
     // (Ghost.lean), so the laws that read no ghost are laws of the original.
     const orig = { ...m, state: Object.fromEntries(Object.entries(m.state).filter(([n2]) => !gv.includes(n2))), step: { ...m.step, state: Object.fromEntries(Object.entries(m.step.state ?? {}).filter(([n2]) => !gv.includes(n2))) } };
     const h = {
         step: sl => { const g = goalsS[allSteps.indexOf(sl)]; return { pr: enc(g, r.proof.trees[g.name]), inst: instOf(sl) }; },
-        sproof: sl => { const { pr, inst } = h.step(sl); return `(${list(insts(inst))}, ${list(qinsts(inst))}, ${list(finsts(inst))}, ${list(pinsts(inst))}, ${list(pfinsts(inst))}, (${pr.tab}, [], ${pr.tree}))`; },
+        sproof: sl => { const { pr, inst } = h.step(sl); return `(${list(insts(inst))}, ${list(qinsts(inst))}, ${list(finsts(inst))}, ${list(pinsts(inst))}, ${list(pfinsts(inst))}, (${pr.tab}, ${pr.hyps}, ${pr.tree}))`; },
         allow: a => {
             const f2 = allowed.get(a);
             if (!f2)