gdp-wired 0.12.2 → 0.12.4

package/README.md

@@ -53,8 +53,8 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Maps, sets and lists of names**: laws at every key ("no day passes its cap"), sets a request carries, conditions
   about every key or every two keys ("a batch is taken only when its values increase"), lists kept in order
   (`examples/sets.ts`, `examples/lists.ts`, `examples/pairs.ts`).
-- **Step laws**: what one step does ("a balance only goes down", "a grant adds one"), and laws over several steps in a
-  row.
+- **Step laws**: what one step does ("a balance only goes down", "a grant adds one"), and laws over up to 64 steps in
+  a row (`examples/steps.ts`).
 - **Histories**: sums and queries over a log of requests, like a sliding-window rate limit.
 - **Orderings at any distance**: "a refund never follows a release", through ghost state that watches the rule.
 - **Liveness**: "every ticket issued is served", in every run that keeps sending the requests that help, including under
@@ -230,8 +230,10 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
   array, and a request that doesn't meet them isn't allowed), read as `Lines.fold.total`; `Lines.every`, `some`, `has`,
   `increasing(by)`, `at(i)`. A lemma about the folds (`({taxed, total}) => taxed.atMost(total)`) is proven by induction
-  over the items when the rule is built, then assumed at every prefix. A fold's start and step, and a lemma, may read the
-  params (`{from: ({fee}) => fee, step: (acc, line, {ceil}) => acc.plus(min(line.amount, ceil))}`); a request is then
+  over the items when the rule is built, then assumed at every prefix; a decision (`decide`) assumes the equations and
+  lemmas too, at the list's end and wherever it reads the list. A lemma reads the folds, the prefix's length and the
+  params, not the items: a fact about every item is a fold's (a count of the items that meet it). A fold's start and
+  step, and a lemma, may read the params (`{from: ({fee}) => fee, step: (acc, line, {ceil}) => acc.plus(min(line.amount, ceil))}`); a request is then
   encoded with them, `rule.encodeInput(values, params)` (`examples/invoices.ts`).
 - **Folds over trees** (`fold(name).params(...).inputs(...).leaf(env => ({...})).node((env, left, right) => ({...}))`,
   `proveFold`): a tree as a value (`{leaf: inputs}` or `{node: inputs, left, right}`), each leaf's values from its inputs
@@ -336,6 +338,10 @@ or two lines and check in 25–44 ms, against 74–117 lines of hand proof and 1
 The proved Bend and Lean rules keep lists and scan them; gdp-wired runs maps and a log (unpruned in this window rule).
 Lean, compiled natively, wins where the state stays small. Details in [`docs/comparison.md`](docs/comparison.md).
 
+Proving and checking: a law over 64 steps proves in about 5 s, and Lean checks its theorem in 47 s (6 s by
+`native_decide`); a law over 32 steps proves in about a second. What changed since the first release, and by how much:
+[`CHANGELOG.md`](CHANGELOG.md).
+
 ## Layout
 
 | Path | What |
@@ -343,7 +349,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 64 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |
@@ -371,7 +377,7 @@ bun test core/compile.test.ts core/runtime.test.ts kernel/history.test.ts
 cd kernel && bun run-kernel.ts && bun test kernel.test.ts
 ```
 
-The whole suite (122 jobs, about 20 minutes of wall time) runs on [Modal](https://modal.com):
+The whole suite (159 jobs, about 6 minutes of wall time and 22 minutes of job time) runs on [Modal](https://modal.com):
 
 ```sh
 modal run modal/run.py --jobs modal/suite.json --out runs/modal/suite && sh modal/reap.sh

package/dist/core/dsl.d.ts

@@ -333,6 +333,10 @@ export declare class CarriedList<V, Fd extends string = never> {
     has(x: V): Cond;
     increasing(by: (item: V) => Term): Cond;
     equations(): Cond[];
+    equationsAt(keys: Term[]): Cond[];
+    private starts;
+    private get keyed();
+    private atKey;
     private get readsParams();
     private p;
     private running;

package/dist/core/dsl.js

@@ -875,6 +875,43 @@ export class CellsRef {
     }
 }
 const fromOf = (d, p) => (typeof d.from === 'number' ? d.from : d.from(p));
+// The keys a condition reads any of these maps at, as terms.
+function keysRead(cs, maps) {
+    const out = [];
+    const e = (t) => {
+        if (t.op === 'get') {
+            if (maps.includes(t.map))
+                out.push(new Term(t.key));
+            e(t.key);
+        }
+        else if (t.op === 'if') {
+            c(t.c);
+            e(t.then);
+            e(t.else);
+        }
+        else if (t.op === 'mul')
+            e(t.a);
+        else if (t.op === 'add' || t.op === 'sub' || t.op === 'min' || t.op === 'max' || t.op === 'prod') {
+            e(t.a);
+            e(t.b);
+        }
+    };
+    const c = (x) => {
+        if (x.op === 'not')
+            c(x.x);
+        else if (x.op === 'and' || x.op === 'or')
+            x.xs.forEach(c);
+        else if (x.op === 'all')
+            c(x.c);
+        else if (x.op !== 'flag') {
+            e(x.a);
+            e(x.b);
+        }
+    };
+    cs.forEach(c);
+    return out;
+}
+const uniqueTerms = (ts) => [...new Map(ts.map(t => [JSON.stringify(t.e), t])).values()];
 export class CarriedList {
     name;
     kind;
@@ -908,15 +945,16 @@ export class CarriedList {
     increasing(by) { return everyKey(k => k.plus(1).lt(this.len).implies(by(this.at(k)).lt(by(this.at(k.plus(1)))))); }
     // What every request is assumed to meet: each fold's start, and at every key one condition (the item's own laws and
     // each fold's step below the length, each lemma up to it), so the prover closes one quantifier, not one per part.
-    equations() {
+    equations() { return [...this.starts(), ...(this.keyed ? [everyKey(k => this.atKey(k))] : [])]; }
+    // The same at the keys given, without the quantifier: what a decision assumes of the list (Rule.decide).
+    equationsAt(keys) { return [...this.starts(), ...(this.keyed ? keys.map(k => this.atKey(k)) : [])]; }
+    starts() { return Object.entries(this.folds).map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(fromOf(d, this.p()))); }
+    get keyed() { return this.kind.invariant(this.kind.value(this.name)).length + Object.keys(this.folds).length + Object.keys(this.lemmas).length > 0; }
+    atKey(k) {
         const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
-        const at = (k) => {
-            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x, this.p())));
-            const below = [...this.kind.invariant(x), ...steps];
-            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k, this.p()))))] : []));
-        };
-        const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
-        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(fromOf(d, this.p()))), ...(any ? [everyKey(at)] : [])];
+        const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x, this.p())));
+        const below = [...this.kind.invariant(x), ...steps];
+        return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k, this.p()))))] : []));
     }
     // Whether a fold reads the params (its start a function, or its step taking them).
     get readsParams() { return Object.values(this.folds).some(d => typeof d.from === 'function' || d.step.length > 2); }
@@ -1704,11 +1742,15 @@ export class Rule {
         return typeof spec.helpful === 'function' ? { ...base, request: req(spec.helpful) } : { ...base, helpful: spec.helpful.map(h => ({ ...(h.when ? { when: h.when(env).c } : {}), request: req(h.request) })) };
     }
     // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state; the
-    // functions' facts are assumed at the arguments the decision reads them at.
+    // functions' facts are assumed at the arguments the decision reads them at, and a carried list's equations (each
+    // fold's start, its step and its lemmas) at the list's end, the key before it and every key the decision reads it at.
     decide(name, given, then) {
         const env = this.env({ flags: false, state: false, queries: false });
         const g = given(env), hyps = [...this.kindAssumptions(), ...this.spec.pre.map(f => f(env).c), ...this.spec.assume.map(f => f(env).c), ...(Array.isArray(g) ? g : [g]).map(c => c.c)];
-        const t = then(env).c, goal = { name, hyps: [...hyps, { op: 'not', x: t }] };
+        const t = then(env).c;
+        const lists = (this.spec.lists2 ?? []).map(([n]) => env[n]);
+        const listed = lists.flatMap(l => l.equationsAt(uniqueTerms([l.len, l.len.minus(1), ...keysRead([...hyps, t], l.maps)])).map(c => c.c));
+        const goal = { name, hyps: [...listed, ...hyps, { op: 'not', x: t }] };
         const facts = this.spec.fns?.length || this.spec.facts?.length ? factsFor(this.machine, goal) : [];
         return withSource({ name, rule: this, given: hyps, then: t, goal: { name, hyps: [...facts, ...goal.hyps] } }, { decision: { given: given, then: then, own: Array.isArray(g) ? g.length : 1 } });
     }
@@ -2349,7 +2391,9 @@ export function crossCheckDecision(d, opts = {}) {
     let checked = 0;
     for (let i = 0; i < (opts.trials ?? 500); i++) {
         const ps = r.randomParams(rand, bound), input = r.randomInput(rand, bound, ps), values = { ...ps, ...numbersOf(input) };
-        const st = { scalars: {}, maps: Object.fromEntries(Object.entries(input).filter((e) => typeof e[1] !== 'number').map(([n, cells]) => [n, new Map(cells)])) };
+        // a map a request carries reads 0 past its cells (a list's encoding keeps no 0 cell)
+        const carried = Object.entries(input).filter((e) => typeof e[1] !== 'number');
+        const st = { scalars: {}, maps: Object.fromEntries(carried.map(([n, cells]) => [n, new Map(cells)])), defaults: Object.fromEntries(carried.map(([n]) => [n, 0])) };
         const keys = exactKeys(keysOf(bound, st), values, st);
         const sc = { vars: values, maps: Object.fromEntries(Object.entries(st.maps).map(([n, cells]) => [n, { cells, dflt: 0 }])), keys, flags: {} };
         const [g, t] = inScope(sc, () => { const env = r['env']({ flags: false, state: false, queries: false }), g = src.given(env); return [all(...(Array.isArray(g) ? g : [g])).ok, src.then(env).ok]; });

package/dist/core/machine.js

@@ -364,6 +364,30 @@ export function interpret(m) {
 // The same machine as JavaScript source: what an app ships. A step reads the state it was given (every query, flag,
 // scalar, key and value first), then writes the maps and the records in place, so it costs the same however large they
 // grow; the state passed in is consumed. fork copies a state to branch from.
+// The runtime's helpers: a compiled module declares the ones it calls (and the ones those call), no others.
+const RUNTIME = [
+    ['$n', `function $n(v, what) { if (typeof v !== 'number' || !Number.isSafeInteger(v) || v < 0) throw new RangeError(what + ' must be a natural below 2^53, not ' + v); return v; }`],
+    ['$x', `function $x(v) { if (v > 9007199254740991) throw new RangeError('a value passed 2^53 - 1, past which the proofs over the naturals no longer describe the run'); return v; }`],
+    ['$m', `function $m(v, what) { if (!(v instanceof Map)) throw new RangeError(what + ' must be a Map of naturals'); for (const [key, x] of v) { $n(key, 'a key of ' + what); $n(x, 'a cell of ' + what); } return v; }`],
+    ['$keys', `function $keys(maps, names) { const keys = new Set(); let past = 0; for (const c of Object.values(maps)) for (const key of c.keys()) past = Math.max(past, key + 1); for (const n of names) for (const key of maps[n].keys()) keys.add(key); return [...keys, past]; }`],
+    ['$breaks', `function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }`],
+    ['$spread', `function $spread(keys, n) { const out = new Set(); for (const k of keys) for (let i = 0; i < n; i++) out.add(k + i); return [...out].sort((a, b) => a - b); }`],
+    ['$dense', `function $dense(keys, f) { const top = keys[keys.length - 1]; if (top > 1000000) throw new RangeError('a write at every key reads its key in arithmetic past a million keys (' + top + ')'); const d = f(top), cells = new Map(); for (let k = 0; k < top; k++) { const v = f(k); if (v !== d) cells.set(k, v); } return {cells, d}; }`],
+    ['$every', `function $every(keys, f) { const past = keys[keys.length - 1], d = f(past), cells = new Map(); for (let i = 0; i < keys.length - 1; i++) { const v = f(keys[i]); if (v !== d) cells.set(keys[i], v); } return {cells, d}; }`],
+];
+function runtimeFor(code) {
+    const used = new Set();
+    for (let grew = true; grew;) {
+        grew = false;
+        const text = code + RUNTIME.filter(([name]) => used.has(name)).map(([, src]) => src).join('');
+        for (const [name] of RUNTIME)
+            if (!used.has(name) && text.includes(`${name}(`)) {
+                used.add(name);
+                grew = true;
+            }
+    }
+    return RUNTIME.filter(([name]) => used.has(name)).map(([, src]) => `${src}\n`).join('');
+}
 export function compileJs(m) {
     const { h, plain, queries, carried } = runnable(m);
     const id = (name) => JSON.stringify(name);
@@ -451,16 +475,8 @@ export function compileJs(m) {
         'if (head > 1024 && 2 * head > records.length) { records.splice(0, head); head = 0; }', `return {scalars, maps: state.maps, history: records, head${h.prune ? ', last: order' : ''}};`);
     else
         lines.push('return Object.keys(dft).length ? {scalars, maps: state.maps, defaults: dft} : {scalars, maps: state.maps};');
-    return `// Generated from the machine ${m.name}. step consumes its state: keep the one it returns (fork to branch).
-function $n(v, what) { if (typeof v !== 'number' || !Number.isSafeInteger(v) || v < 0) throw new RangeError(what + ' must be a natural below 2^53, not ' + v); return v; }
-function $x(v) { if (v > 9007199254740991) throw new RangeError('a value passed 2^53 - 1, past which the proofs over the naturals no longer describe the run'); return v; }
-function $m(v, what) { if (!(v instanceof Map)) throw new RangeError(what + ' must be a Map of naturals'); for (const [key, x] of v) { $n(key, 'a key of ' + what); $n(x, 'a cell of ' + what); } return v; }
-function $keys(maps, names) { const keys = new Set(); let past = 0; for (const c of Object.values(maps)) for (const key of c.keys()) past = Math.max(past, key + 1); for (const n of names) for (const key of maps[n].keys()) keys.add(key); return [...keys, past]; }
-${fns.map((name, i) => `const fn${i} = (${m.fns[name].js});\n${m.fns[name].call ? `const fnc${i} = (${m.fns[name].call});\n` : ''}`).join('')}function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }
-function $spread(keys, n) { const out = new Set(); for (const k of keys) for (let i = 0; i < n; i++) out.add(k + i); return [...out].sort((a, b) => a - b); }
-function $dense(keys, f) { const top = keys[keys.length - 1]; if (top > 1000000) throw new RangeError('a write at every key reads its key in arithmetic past a million keys (' + top + ')'); const d = f(top), cells = new Map(); for (let k = 0; k < top; k++) { const v = f(k); if (v !== d) cells.set(k, v); } return {cells, d}; }
-function $every(keys, f) { const past = keys[keys.length - 1], d = f(past), cells = new Map(); for (let i = 0; i < keys.length - 1; i++) { const v = f(keys[i]); if (v !== d) cells.set(keys[i], v); } return {cells, d}; }
-export function init(params) {
+    const fnDefs = fns.map((name, i) => `const fn${i} = (${m.fns[name].js});\n${m.fns[name].call ? `const fnc${i} = (${m.fns[name].call});\n` : ''}`).join('');
+    const code = `export function init(params) {
   const env = ${env(false)}, s = {};
   return {scalars: {${Object.entries(plain.state).map(([name, e]) => `${id(name)}: ${ex(e)}`).join(', ')}}, maps: {${Object.keys(plain.maps ?? {}).map(name => `${id(name)}: new Map()`).join(', ')}}${h ? ', history: [], head: 0' : ''}};
 }
@@ -471,6 +487,8 @@ export function step(params, state, input) {
   ${lines.join('\n  ')}
 }
 `;
+    return `// Generated from the machine ${m.name}. step consumes its state: keep the one it returns (fork to branch).
+${runtimeFor(fnDefs + code)}${fnDefs}${code}`;
 }
 // Generated code as a function. Every caller passes source this library generated from its own terms, or a function's
 // `js` the rule's author wrote (code, as the rule itself is), never data; the lint's implied-eval rule is waived here

package/dist/kernel/kernel.js

@@ -1163,12 +1163,14 @@ export function stepLawObligations(machine, laws, instances, sl) {
 // `perStep`: a step law's own instances, where it has them (else `instances`).
 // Each frame's hypotheses read no name a later step's request is read by: the condition the Lean twin's proof needs
 // (Sets.lean's checkSKStep, `avoids (szone s sl)`; plain flags are inlined here, so their names never occur), checked
-// here alike.
+// here alike. A quantified flag's keys are free of it: where the flag is 1 its condition holds at every key, so at a
+// key a later step names too (and the flag, its witness and its condition read none).
+const lawsOnly = (inst) => Object.fromEntries(Object.entries(inst).filter(([n]) => !n.startsWith('?')));
 export function checkStepLaws(m, laws, stepLaws, proof) {
     return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => {
         const inst = proof.perStep?.[sl.name] ?? proof.instances, plain = m.history ? historyMachine(m).machine : m;
         const zone = stepZone(plain, sl.steps ?? 1);
-        return [...assumed(laws, inst), ...assumed(plain.facts ?? [], inst), ...closing(plain, inst)].every(c => !mentions(c, zone))
+        return [...assumed(laws, inst), ...assumed(plain.facts ?? [], inst), ...closing(plain, lawsOnly(inst))].every(c => !mentions(c, zone))
             && stepLawObligations(m, laws, inst, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name]));
     });
 }

package/dist/kernel/prove.js

@@ -665,6 +665,17 @@ const flagInstances = (m, keys, focus = []) => Object.fromEntries(Object.entries
     const n = boundOf(c).length;
     return [[`?${f}`, n === 1 ? keys : focus.length ? related(keys, focus, n).flat() : tuples(keys, n)]];
 }));
+// A k-step law whose steps keep a condition (a flag that holds at one step and is read again at the next) fails at a
+// later step's witness only where the condition held before: so, per quantified flag over one key, the instances at the
+// law's own keys and that flag's witness at every step (a later step's witness is a key an earlier frame may name, as a
+// flag holds at every key: kernel.ts's checkStepLaws). Few instances, where the shared ones are many and mostly idle.
+const keptAcross = (m, laws, inst, own, k) => k < 2 ? [] : Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => {
+    if (c.op !== 'all' || c.keys?.length)
+        return [];
+    const ws = Array.from({ length: k }, (_, i) => ({ op: 'var', name: i ? `w?${f}@${i + 1}` : `w?${f}` })), keys = [...own, ...ws.slice(0, 1)];
+    const keep = new Set(keys.map(e => JSON.stringify(e)));
+    return [Object.fromEntries(Object.entries(inst).map(([n, ks]) => [n, arity(m, laws, n) === 1 ? [...ks.filter(e => keep.has(JSON.stringify(e))), ...(n === `?${f}` ? ws.slice(1) : [])] : ks]))];
+});
 const pairFlags = (m) => Object.values(m.step.flags ?? {}).some(c => c.op === 'all' && !!c.keys?.length);
 // How many keys each instance of a name takes: a law's, or a quantified flag's (?f).
 const arity = (m, laws, n) => {
@@ -677,7 +688,8 @@ const arity = (m, laws, n) => {
 // several keys), the every-key laws and flags at every key they read a map at (a law about several keys at tuples
 // relating `focus`, the goals' own keys).
 function instancesFor(m, laws, build, opts = {}) {
-    let inst = opts.start ?? (opts.seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : opts.seed])), ...flagInstances(m, opts.seed, opts.focus) } : {});
+    const seed = opts.seed && [...new Map(opts.seed.map(e => [JSON.stringify(e), e])).values()];
+    let inst = opts.start ?? (seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : seed])), ...flagInstances(m, seed, opts.focus) } : {});
     const reads = opts.reads ?? (!opts.seed || shifts(m) || laws.some(l => l.keys?.length) || pairFlags(m));
     for (let round = 0; round < 2; round++) {
         if (m.facts?.length)
@@ -703,7 +715,7 @@ const union = (a, b, m) => {
     for (const [n, keys] of Object.entries(b)) {
         const k = arity(m, [], n), groups = (ks) => Array.from({ length: Math.floor(ks.length / k) }, (_, t) => ks.slice(t * k, (t + 1) * k));
         const seen = new Set(groups(out[n] ?? []).map(g => JSON.stringify(g)));
-        out[n] = [...(out[n] ?? []), ...groups(keys).filter(g => !seen.has(JSON.stringify(g))).flat()];
+        out[n] = [...(out[n] ?? []), ...groups(keys).filter(g => !seen.has(JSON.stringify(g)) && !!seen.add(JSON.stringify(g))).flat()];
     }
     return out;
 };
@@ -814,7 +826,8 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     // Each step law its own instances, from its own goal: the keys the step and the laws read, and its own (a k-step
     // law's later frames read keys no other step law has); where positions shift or a law is about several keys, the
     // keys its goal reads a map at too. A frame's hypotheses read no name the run introduces later (kernel.ts's
-    // stepZone), so a k-step law drops the keys that read one.
+    // stepZone), so a k-step law drops the keys that read one; but a flag that holds at every key holds at a later step's
+    // key too: where these instances don't prove it, each flag at its own witness at every step is tried (keptAcross).
     const shared = [...readKeys(plain, laws), ...witnesses(plain)], named = [...laws, ...(plain.facts ?? [])], reads = shifts(plain) || laws.some(l => l.keys?.length) || pairFlags(plain);
     const own = (sl) => [...[sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC),
         ...[sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : []))];
@@ -828,7 +841,17 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     let nodes = base.nodes, leaves = base.leaves;
     for (const sl of stepLaws)
         for (const goal of stepLawObligations(m, laws, perStep[sl.name] ?? instances, sl)) {
-            const out = grow(goal);
+            let out = grow(goal);
+            // A k-step law that reads a condition kept across its steps: each flag at its own witnesses, at every step.
+            if (!('tree' in out))
+                for (const kept of keptAcross(plain, laws, perStep[sl.name] ?? instances, own(sl), sl.steps ?? 1)) {
+                    const again = grow(stepLawObligations(m, laws, kept, sl)[0]);
+                    if ('tree' in again) {
+                        out = again;
+                        perStep[sl.name] = kept;
+                        break;
+                    }
+                }
             if (!('tree' in out))
                 return { proven: false, nodes, leaves, failed: { goal: goal.name, stuck: out.stuck, ...(out.witness ? { witness: out.witness } : {}), ...(out.why ? { why: out.why } : {}) }, checked: false };
             trees[goal.name] = out.tree;

package/dist/lean-kernel/emit.d.ts

@@ -145,6 +145,7 @@ export type LeanItem = {
 };
 export declare function toLean(items: LeanItem[], opts?: {
     title?: string;
+    native?: boolean;
 }): string;
 export declare function leanProject(file: string, opts?: {
     name?: string;

package/dist/lean-kernel/emit.js

@@ -214,11 +214,11 @@ def ${name}_tree : Tree :=
     return tamper
         ? `-- TAMPERED: ${ex.name}${dropStep ? ", the first leaf's derivation without its last step" : ''}. Lean computes the check to false.
 ${body}
-example : checkGoal ${name}_goal ${name}_tree = false := by decide +kernel`
+example : checkGoal ${name}_goal ${name}_tree = false := by ${checkBy}`
         : `-- ${ex.name}  (${cols.length} columns)
 ${body}
 theorem ${name} : ∀ env maps, ¬ ∀ c ∈ ${name}_goal.hyps, evalC env maps c = true :=
-  sound ${name}_goal ${name}_tree (by decide +kernel)`;
+  sound ${name}_goal ${name}_tree (by ${checkBy})`;
 }
 // Whole machines through Kern.machine_sound: Lean builds the goals from the machine; the trees are the kernel's.
 export function machineToLean(id, m, laws, corollary) {
@@ -255,15 +255,17 @@ export function machineToLean(id, m, laws, corollary) {
 def ${id}_machine : FMachine := ${lit(m)}
 def ${id}_proof : MachineProof := ${list(proof)}
 theorem ${id}_laws : ∀ maps ρ, FReach ${id}_machine maps ρ → ∀ l ∈ ${id}_proof.map (·.1), evalC ρ maps l = true :=
-  fmachine_sound ${id}_machine ${id}_proof (by decide +kernel)${corollary ? `\n${corollary}` : ''}`;
+  fmachine_sound ${id}_machine ${id}_proof (by ${checkBy})${corollary ? `\n${corollary}` : ''}`;
     }
     return `-- ${m.name}: ${laws.map(l => l.name).join('; ')}  (variables ${vars.map((v2, j) => `${j} ${v2}`).join(', ')})
 def ${id}_machine : Machine := ${machine}
 def ${id}_proof : MachineProof := ${list(proof)}
 theorem ${id}_laws : ∀ maps ρ, Reach ${id}_machine maps ρ → ∀ l ∈ ${id}_proof.map (·.1), evalC ρ maps l = true :=
-  machine_sound ${id}_machine ${id}_proof (by decide +kernel)${corollary ? `\n${corollary}` : ''}`;
+  machine_sound ${id}_machine ${id}_proof (by ${checkBy})${corollary ? `\n${corollary}` : ''}`;
 }
 export const TRUE = '.le (.const 0) (.const 0)';
+// The tactic each check is closed by: `decide +kernel`, or `native_decide` for toLean's `native`.
+let checkBy = 'decide +kernel';
 export const grown = (g) => { const o = grow(g); if (!('tree' in o))
     throw new Error(`${g.name}: stuck`); return o.tree; };
 // Loops through Kern.loop_halts_of: the loop's machine (Live.lean's Loop.machine) with its invariants as laws, and its
@@ -295,7 +297,7 @@ def ${id}_fold : Fold := ${fold}
 def ${id}_proof : FoldProof := ${list(proof)}
 theorem ${id}_laws : ∀ maps ρ, evalC ρ maps ${id}_fold.pre = true → ∀ t, Allowed ${id}_fold ρ maps t →
     ∀ l ∈ ${id}_proof.map (·.1), evalC (foldT ${id}_fold ρ maps t) maps l = true :=
-  fold_sound ${id}_fold ${id}_proof (by decide +kernel)${extra}`;
+  fold_sound ${id}_fold ${id}_proof (by ${checkBy})${extra}`;
 }
 // Machines with maps (and flags) through Kern.fmmachine_sound: Lean inlines the flags, then builds the start and step
 // goals (read-over-write, ∀-laws at the proof's keys and at a skolem); the trees and the instance keys are the kernel's.
@@ -433,10 +435,10 @@ export function mmachineToLean(id, m, laws, opts = {}) {
         return `-- Progress: ${pc.name}
 def ${pc.id} : Progress := ${record(pc.when)}
 theorem ${pc.id}_holds : ProgressHolds ${id}_machine ${pc.id} :=
-  progress_sound ${id}_machine ${id}_proof ${pc.id} ${id}_check (by decide +kernel)${pc.tamper ? `
+  progress_sound ${id}_machine ${id}_proof ${pc.id} ${id}_check (by ${checkBy})${pc.tamper ? `
 -- TAMPERED: ${pc.tamper.what}: the proof above offered for it. Lean computes the check to false.
 def ${pc.id}_tampered : Progress := ${record(pc.tamper.when)}
-example : checkProgress ${id}_machine ${id}_proof ${pc.id}_tampered = false := by decide +kernel` : ''}`;
+example : checkProgress ${id}_machine ${id}_proof ${pc.id}_tampered = false := by ${checkBy}` : ''}`;
     });
     // Step laws through Kern.steplaw_sound: `when` and `then` sent with the flags inlined (as kernel.ts's goal has them);
     // a law over several steps goes through smachineToLean.
@@ -461,20 +463,20 @@ def ${id}_step${j} : StepLaw := ⟨${when ? any0.c(inlineFlags(when)) : TRUE},
   ${list(insts)},
   (${pr.tab}, ${pr.tree})⟩
 theorem ${id}_step${j}_holds : StepLawHolds ${id}_machine ${id}_step${j} :=
-  steplaw_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by decide +kernel)`;
+  steplaw_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by ${checkBy})`;
     });
     const machineDef = `def ${id}_machine : FMMachine := ${lit(m)}`;
     return `-- ${m.name}: ${laws.map(l => l.name).join('; ')}${flagNames.length ? `, with flags ${flagNames.join(', ')}` : ''}  (variables ${vars.map((v2, j) => `${j} ${v2}`).join(', ')}; maps ${mapNames.map((v2, j) => `${j} ${v2}`).join(', ')})
 ${machineDef}
 ${entries.join('\n')}
 def ${id}_proof : List MEntry := ${list(laws.map((_, j) => `${id}_e${j}`))}
-theorem ${id}_check : checkFMMachine ${id}_machine ${id}_proof = true := by decide +kernel
+theorem ${id}_check : checkFMMachine ${id}_machine ${id}_proof = true := by ${checkBy}
 theorem ${id}_laws : ∀ ρ M, FMReach ${id}_machine ρ M → ∀ e ∈ ${id}_proof, e.law.Holds ρ M :=
   fmmachine_sound ${id}_machine ${id}_proof ${id}_check
 ${readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat)', hyp: `FMReach ${id}_machine ρ μ`, call: `${id}_laws ρ μ h` })}${opts.corollary ? `\n${opts.corollary}` : ''}${opts.tamper ? `
 -- TAMPERED: ${opts.tamper.what}. Lean computes the check to false.
 def ${id}_tampered : FMMachine := ${lit(opts.tamper.machine)}
-example : checkFMMachine ${id}_tampered ${id}_proof = false := by decide +kernel` : ''}${progress.length ? `\n\n${progress.join('\n\n')}` : ''}${stepRecords.length ? `\n\n${stepRecords.join('\n\n')}` : ''}`;
+example : checkFMMachine ${id}_tampered ${id}_proof = false := by ${checkBy}` : ''}${progress.length ? `\n\n${progress.join('\n\n')}` : ''}${stepRecords.length ? `\n\n${stepRecords.join('\n\n')}` : ''}`;
 }
 // Machines with sets through Kern.smachine_sound and Kern.skstep_sound (Sets.lean): maps a request carries, flags that
 // hold at every key (each its 0/1 variable ?f, closed at the proof's keys and at a witness w?f) and writes at every
@@ -523,7 +525,7 @@ def ${id}_step${j} : SKStep := ⟨⟨${list(Array.from({ length: kk }, (_, s2) =
   ${pr.hyps},
   ${list(Array.from({ length: kk - 1 }, (_, s2) => list(Object.keys(m.state).map(n2 => `(${ix(n2)}, ${ix(stateName(n2, s2 + 1))})`))))}⟩
 theorem ${id}_step${j}_holds : SKStepHolds ${id}_machine ${id}_step${j} :=
-  skstep_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by decide +kernel)`;
+  skstep_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by ${checkBy})`;
             } }));
     // A refinement (Refine.lean's SRefined): its step law, that the spec stutters or allows the request it is sent; srefines
     // says what the whole means.
@@ -531,11 +533,11 @@ theorem ${id}_step${j}_holds : SKStepHolds ${id}_machine ${id}_step${j} :=
         claims.push({ steps: [stepLaws[0]], allows: [], render: h => {
                 const primesL = list(Object.keys(m.state).map(s2 => `(${ix(s2)}, ${ix(`${s2}'`)})`)), primeMapsL = list(Object.keys(m.maps ?? {}).map(mp => `(${mx(mp)}, ${mx(`${mp}'`)})`));
                 const proofL = h.sproof(stepLaws[0]);
-                return `theorem ${id}_allowed : checkSKStep ${id}_machine ${id}_proof (srStep ${id}_refined ${primesL} ${primeMapsL} ${proofL}) = true := by decide +kernel
+                return `theorem ${id}_allowed : checkSKStep ${id}_machine ${id}_proof (srStep ${id}_refined ${primesL} ${primeMapsL} ${proofL}) = true := by ${checkBy}
 theorem ${id}_refines : ∀ ρ M, SReach ${id}_refined.impl ρ M → ∃ ρc Mc σ Ms, SReach ${id}_refined.full ρc Mc ∧ Agree ${id}_refined.SV ρc ρ
     ∧ (∀ mp, mp ∉ ${id}_refined.SM → Mc mp = M mp) ∧ SReach ${id}_refined.spec σ Ms ∧ Agree ${id}_refined.X σ ρc
     ∧ (∀ mp, mp ∉ ${id}_refined.IM → mp ∉ ${id}_refined.spec.carried → Ms mp = Mc mp) ∧ ∀ e ∈ ${id}_proof, e.Holds ρc Mc :=
-  srefines ${id}_refined (by decide +kernel) (by decide +kernel) ${id}_proof ${id}_check ${rf.specPre} ⟨rfl, rfl⟩ ${primesL} ${primeMapsL} ${proofL} ${id}_allowed (by decide +kernel) (by decide +kernel) (by decide +kernel)`;
+  srefines ${id}_refined (by ${checkBy}) (by ${checkBy}) ${id}_proof ${id}_check ${rf.specPre} ⟨rfl, rfl⟩ ${primesL} ${primeMapsL} ${proofL} ${id}_allowed (by ${checkBy}) (by ${checkBy}) (by ${checkBy})`;
             } });
     // Liveness (Live.lean's sleads_sound): its step laws (stay, cover, one per helpful request), and where each helpful
     // request is proven allowed in its region, the same under weak fairness (sleads_wf_sound).
@@ -546,7 +548,7 @@ theorem ${id}_refines : ∀ ρ M, SReach ${id}_refined.impl ρ M → ∃ ρc Mc
                 const al = allows.map(h.allow);
                 const wf = al.every(a => a !== undefined) ? `
 def ${lid}_ap : List (List (Nat × E) × SProof × List E) := ${list(al)}
-theorem ${lid}_allows : sliveAllowsOk ${id}_machine ${id}_proof ${lid} ${lid}_ap = true := by decide +kernel
+theorem ${lid}_allows : sliveAllowsOk ${id}_machine ${id}_proof ${lid} ${lid}_ap = true := by ${checkBy}
 /-- ${l.name}, under weak fairness: along every run that takes each helpful request whenever, from some point on, it
 stays allowed, \`from\` is followed by \`to\`. -/
 theorem ${lid}_holds_wf (run : SRun ${id}_machine)
@@ -560,10 +562,10 @@ def ${lid} : Live := ${liveLit(l, { e, c }, ix, list(Object.keys(m.state).map(s2
 def ${lid}_sp : SProof := ${h.sproof(stay)}
 def ${lid}_cp : SProof := ${h.sproof(cover)}
 def ${lid}_hp : List SProof := ${list(helps.map(h.sproof))}
-theorem ${lid}_ok : sliveOk ${id}_machine ${lid} = true := by decide +kernel
-theorem ${lid}_stay : checkSKStep ${id}_machine ${id}_proof (sliveStep ${lid} ${lid}.pend (liveStayC ${lid}) ${lid}_sp) = true := by decide +kernel
-theorem ${lid}_cover : checkSKStep ${id}_machine ${id}_proof (sliveStep ${lid} ${lid}.pend (liveCoverC ${lid}) ${lid}_cp) = true := by decide +kernel
-theorem ${lid}_helps : sliveHelpsOk ${id}_machine ${id}_proof ${lid} ${lid}_hp = true := by decide +kernel
+theorem ${lid}_ok : sliveOk ${id}_machine ${lid} = true := by ${checkBy}
+theorem ${lid}_stay : checkSKStep ${id}_machine ${id}_proof (sliveStep ${lid} ${lid}.pend (liveStayC ${lid}) ${lid}_sp) = true := by ${checkBy}
+theorem ${lid}_cover : checkSKStep ${id}_machine ${id}_proof (sliveStep ${lid} ${lid}.pend (liveCoverC ${lid}) ${lid}_cp) = true := by ${checkBy}
+theorem ${lid}_helps : sliveHelpsOk ${id}_machine ${id}_proof ${lid} ${lid}_hp = true := by ${checkBy}
 /-- ${l.name}: along every run that takes each helpful request infinitely often, \`from\` is followed by \`to\`. -/
 theorem ${lid}_holds (run : SRun ${id}_machine)
     (fair : ∀ h ∈ ${lid}.helps, ∀ n, ∃ m, n ≤ m ∧ ∀ p ∈ h.2, (run.req m).1 p.1 = evalE (run.st m).1 (run.st m).2 p.2) :
@@ -577,13 +579,13 @@ theorem ${lid}_holds (run : SRun ${id}_machine)
         claims.push({ steps: [], allows: [], render: () => `/-- ${lp0.loop.name} halts: for params meeting its precondition, no run of turns goes on forever. -/
 theorem ${id}_halts : ∀ maps ρ0, evalC ρ0 maps ${id}_loop.pre = true →
     ¬ ∃ f : Nat → Nat → Nat, f 0 = applyS ${id}_loop.init ρ0 maps ∧ ∀ n, Turn ${id}_loop maps (f n) (f (n + 1)) :=
-  loop_halts_of ${id}_loop ${id}_live0 rfl rfl (by intro h hh; simp only [${id}_live0, List.mem_singleton] at hh; subst hh; rfl) (by decide +kernel) ${id}_live0_holds${lp0.tamper ? `
+  loop_halts_of ${id}_loop ${id}_live0 rfl rfl (by intro h hh; simp only [${id}_live0, List.mem_singleton] at hh; subst hh; rfl) (by ${checkBy}) ${id}_live0_holds${lp0.tamper ? `
 -- TAMPERED: ${lp0.tamper.what}. Lean computes the checks to false.
 def ${id}_tampered : SMachine := Loop.machine ${loopLit(lp0.tamper.loop)}
 example : (checkSMachine ${id}_tampered ${id}_proof && sliveOk ${id}_tampered ${id}_live0
     && checkSKStep ${id}_tampered ${id}_proof (sliveStep ${id}_live0 ${id}_live0.pend (liveStayC ${id}_live0) ${id}_live0_sp)
     && checkSKStep ${id}_tampered ${id}_proof (sliveStep ${id}_live0 ${id}_live0.pend (liveCoverC ${id}_live0) ${id}_live0_cp)
-    && sliveHelpsOk ${id}_tampered ${id}_proof ${id}_live0 ${id}_live0_hp) = false := by decide +kernel` : ''}` });
+    && sliveHelpsOk ${id}_tampered ${id}_proof ${id}_live0 ${id}_live0_hp) = false := by ${checkBy}` : ''}` });
     // Ghosts (Ghost.lean's sghost_laws): the laws that read no ghost hold of the machine without its ghosts.
     if (gv.length)
         claims.push({ steps: [], allows: [], render: () => `-- The laws that read no ghost hold of the machine without its ghosts.
@@ -724,9 +726,9 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
             throw new Error(`${id}: ${g.name} not proven`); const x2 = enc(g, out.tree); return `(${x2.tab}, ${x2.tree})`; });
         const tampered = (opts.historyTampers ?? []).map((t, j) => `-- TAMPERED: ${t.what}. Lean computes the check to false.
 def ${id}_tampered${j} : HMachine := ${hlit(t.relations)}
-example : checkHMachine ${id}_tampered${j} ${id}_proof ${t.withRecordTrees ? `${id}_records` : '[]'} = false := by decide +kernel`);
+example : checkHMachine ${id}_tampered${j} ${id}_proof ${t.withRecordTrees ? `${id}_records` : '[]'} = false := by ${checkBy}`);
         return `def ${id}_records : List (List VDef × Tree) := ${list(records)}
-theorem ${id}_hcheck : checkHMachine ${id}_hist ${id}_proof ${id}_records = true := by decide +kernel
+theorem ${id}_hcheck : checkHMachine ${id}_hist ${id}_proof ${id}_records = true := by ${checkBy}
 theorem ${id}_hlaws : ∀ ρ M hist, HReach ${id}_hist ρ M hist → ∀ e ∈ ${id}_proof, e.Holds ρ M :=
   hmachine_sound ${id}_hist ${id}_proof ${id}_records ${id}_hcheck
 ${readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat) (hist : List (Nat → Nat))', hyp: `HReach ${id}_hist ρ μ hist`, call: `${id}_hlaws ρ μ hist h` })}${tampered.length ? `\n${tampered.join('\n')}` : ''}`;
@@ -784,18 +786,18 @@ ${rf ? `def ${id}_refined : SRefined := ⟨${lit(rf.impl)},
 def ${id}_machine : SMachine := ${id}_refined.full` : gv.length ? `def ${id}_ghosted : SGhosted := ⟨${lit(orig)},
   ${list(gv.map(v2 => `(${ix(v2)}, ${e(m.state[v2])}, ${e(m.step.state?.[v2] ?? { op: 'var', name: v2 })})`))}⟩
 def ${id}_machine : SMachine := ${id}_ghosted.full
-theorem ${id}_ghostOk : sghostOk ${id}_ghosted = true := by decide +kernel` : hm ? `def ${id}_hist : HMachine := ${hlit(hm.history.relations ?? [])}
+theorem ${id}_ghostOk : sghostOk ${id}_ghosted = true := by ${checkBy}` : hm ? `def ${id}_hist : HMachine := ${hlit(hm.history.relations ?? [])}
 def ${id}_machine : SMachine := ${id}_hist.plain` : lp0 ? `def ${id}_loop : Loop := ${loopLit(lp0.loop)}
 def ${id}_machine : SMachine := ${id}_loop.machine` : `def ${id}_machine : SMachine := ${lit(m)}`}
 ${entries.join('\n')}
 def ${id}_proof : List SEntry := ${list(laws.map((_, j) => `${id}_e${j}`))}
-theorem ${id}_check : checkSMachine ${id}_machine ${id}_proof = true := by decide +kernel
+theorem ${id}_check : checkSMachine ${id}_machine ${id}_proof = true := by ${checkBy}
 theorem ${id}_laws : ∀ ρ M, SReach ${id}_machine ρ M → ∀ e ∈ ${id}_proof, e.Holds ρ M :=
   smachine_sound ${id}_machine ${id}_proof ${id}_check
 ${hm ? histBlock() : readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat)', hyp: `SReach ${id}_machine ρ μ`, call: `${id}_laws ρ μ h` })}${opts.noFacts ? '' : factsProof(id, m, mapNames, vars, opts.simp)}${opts.tamper ? `
 -- TAMPERED: ${opts.tamper.what}. Lean computes the check to false.
 def ${id}_tampered : SMachine := ${lit(opts.tamper.machine)}
-example : checkSMachine ${id}_tampered ${id}_proof = false := by decide +kernel` : ''}${records.length ? `\n\n${records.join('\n\n')}` : ''}${opts.after ? `\n\n${opts.after(ix)}` : ''}`;
+example : checkSMachine ${id}_tampered ${id}_proof = false := by ${checkBy}` : ''}${records.length ? `\n\n${records.join('\n\n')}` : ''}${opts.after ? `\n\n${opts.after(ix)}` : ''}`;
 }
 // A function defined by a recurrence (core/dsl.ts recur): its Lean definition by the same recurrence, and its lemmas
 // proven together by induction (each case by omega, its min, max and ifs split first), and its laws between two points
@@ -1030,7 +1032,23 @@ export function hmachineToLean(id, m, laws, tampers = [], corollary) {
 // over named variables); step laws with `<id>_stepN_holds` (on the plain machine, `<id>s`, for a machine with a history);
 // loops with `<id>_halts`; decisions with `<id>`. A machine with sets has its step laws as `<id>_stepN_holds`.
 // Throws if the kernel can't prove one.
+//
+// `native`: each check by `native_decide` (compiled Lean, several times faster on a large certificate), not by
+// `decide +kernel` (Lean's kernel alone). Every such theorem then also rests on an axiom of its own that `#print axioms`
+// names (`…_native.native_decide.ax_…`): it trusts Lean's compiler, its runtime and the C compiler. Defaults to off, or
+// to GDP_LEAN_NATIVE=1 (the suite's quick runs); a release's proofs stay on Lean's kernel and its core axioms.
 export function toLean(items, opts = {}) {
+    const outer = checkBy;
+    const env = globalThis.process?.env;
+    checkBy = (opts.native ?? env?.GDP_LEAN_NATIVE === '1') ? 'native_decide' : 'decide +kernel';
+    try {
+        return toLeanWith(items, opts);
+    }
+    finally {
+        checkBy = outer;
+    }
+}
+function toLeanWith(items, opts) {
     const ident = (id) => { const s = id.replace(/[^A-Za-z0-9_]/g, '_'); return /^[A-Za-z]/.test(s) ? s : `x_${s}`; };
     const parts = [], theorems = [];
     let goals = 0;