gdp-wired 0.12.3 → 0.12.4

package/README.md

@@ -53,8 +53,8 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Maps, sets and lists of names**: laws at every key ("no day passes its cap"), sets a request carries, conditions
   about every key or every two keys ("a batch is taken only when its values increase"), lists kept in order
   (`examples/sets.ts`, `examples/lists.ts`, `examples/pairs.ts`).
-- **Step laws**: what one step does ("a balance only goes down", "a grant adds one"), and laws over several steps in a
-  row.
+- **Step laws**: what one step does ("a balance only goes down", "a grant adds one"), and laws over up to 64 steps in
+  a row (`examples/steps.ts`).
 - **Histories**: sums and queries over a log of requests, like a sliding-window rate limit.
 - **Orderings at any distance**: "a refund never follows a release", through ghost state that watches the rule.
 - **Liveness**: "every ticket issued is served", in every run that keeps sending the requests that help, including under
@@ -230,8 +230,10 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
   array, and a request that doesn't meet them isn't allowed), read as `Lines.fold.total`; `Lines.every`, `some`, `has`,
   `increasing(by)`, `at(i)`. A lemma about the folds (`({taxed, total}) => taxed.atMost(total)`) is proven by induction
-  over the items when the rule is built, then assumed at every prefix. A fold's start and step, and a lemma, may read the
-  params (`{from: ({fee}) => fee, step: (acc, line, {ceil}) => acc.plus(min(line.amount, ceil))}`); a request is then
+  over the items when the rule is built, then assumed at every prefix; a decision (`decide`) assumes the equations and
+  lemmas too, at the list's end and wherever it reads the list. A lemma reads the folds, the prefix's length and the
+  params, not the items: a fact about every item is a fold's (a count of the items that meet it). A fold's start and
+  step, and a lemma, may read the params (`{from: ({fee}) => fee, step: (acc, line, {ceil}) => acc.plus(min(line.amount, ceil))}`); a request is then
   encoded with them, `rule.encodeInput(values, params)` (`examples/invoices.ts`).
 - **Folds over trees** (`fold(name).params(...).inputs(...).leaf(env => ({...})).node((env, left, right) => ({...}))`,
   `proveFold`): a tree as a value (`{leaf: inputs}` or `{node: inputs, left, right}`), each leaf's values from its inputs
@@ -336,6 +338,10 @@ or two lines and check in 25–44 ms, against 74–117 lines of hand proof and 1
 The proved Bend and Lean rules keep lists and scan them; gdp-wired runs maps and a log (unpruned in this window rule).
 Lean, compiled natively, wins where the state stays small. Details in [`docs/comparison.md`](docs/comparison.md).
 
+Proving and checking: a law over 64 steps proves in about 5 s, and Lean checks its theorem in 47 s (6 s by
+`native_decide`); a law over 32 steps proves in about a second. What changed since the first release, and by how much:
+[`CHANGELOG.md`](CHANGELOG.md).
+
 ## Layout
 
 | Path | What |
@@ -343,7 +349,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 64 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |
@@ -371,7 +377,7 @@ bun test core/compile.test.ts core/runtime.test.ts kernel/history.test.ts
 cd kernel && bun run-kernel.ts && bun test kernel.test.ts
 ```
 
-The whole suite (122 jobs, about 20 minutes of wall time) runs on [Modal](https://modal.com):
+The whole suite (159 jobs, about 6 minutes of wall time and 22 minutes of job time) runs on [Modal](https://modal.com):
 
 ```sh
 modal run modal/run.py --jobs modal/suite.json --out runs/modal/suite && sh modal/reap.sh

package/dist/core/dsl.d.ts

@@ -333,6 +333,10 @@ export declare class CarriedList<V, Fd extends string = never> {
     has(x: V): Cond;
     increasing(by: (item: V) => Term): Cond;
     equations(): Cond[];
+    equationsAt(keys: Term[]): Cond[];
+    private starts;
+    private get keyed();
+    private atKey;
     private get readsParams();
     private p;
     private running;

package/dist/core/dsl.js

@@ -875,6 +875,43 @@ export class CellsRef {
     }
 }
 const fromOf = (d, p) => (typeof d.from === 'number' ? d.from : d.from(p));
+// The keys a condition reads any of these maps at, as terms.
+function keysRead(cs, maps) {
+    const out = [];
+    const e = (t) => {
+        if (t.op === 'get') {
+            if (maps.includes(t.map))
+                out.push(new Term(t.key));
+            e(t.key);
+        }
+        else if (t.op === 'if') {
+            c(t.c);
+            e(t.then);
+            e(t.else);
+        }
+        else if (t.op === 'mul')
+            e(t.a);
+        else if (t.op === 'add' || t.op === 'sub' || t.op === 'min' || t.op === 'max' || t.op === 'prod') {
+            e(t.a);
+            e(t.b);
+        }
+    };
+    const c = (x) => {
+        if (x.op === 'not')
+            c(x.x);
+        else if (x.op === 'and' || x.op === 'or')
+            x.xs.forEach(c);
+        else if (x.op === 'all')
+            c(x.c);
+        else if (x.op !== 'flag') {
+            e(x.a);
+            e(x.b);
+        }
+    };
+    cs.forEach(c);
+    return out;
+}
+const uniqueTerms = (ts) => [...new Map(ts.map(t => [JSON.stringify(t.e), t])).values()];
 export class CarriedList {
     name;
     kind;
@@ -908,15 +945,16 @@ export class CarriedList {
     increasing(by) { return everyKey(k => k.plus(1).lt(this.len).implies(by(this.at(k)).lt(by(this.at(k.plus(1)))))); }
     // What every request is assumed to meet: each fold's start, and at every key one condition (the item's own laws and
     // each fold's step below the length, each lemma up to it), so the prover closes one quantifier, not one per part.
-    equations() {
+    equations() { return [...this.starts(), ...(this.keyed ? [everyKey(k => this.atKey(k))] : [])]; }
+    // The same at the keys given, without the quantifier: what a decision assumes of the list (Rule.decide).
+    equationsAt(keys) { return [...this.starts(), ...(this.keyed ? keys.map(k => this.atKey(k)) : [])]; }
+    starts() { return Object.entries(this.folds).map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(fromOf(d, this.p()))); }
+    get keyed() { return this.kind.invariant(this.kind.value(this.name)).length + Object.keys(this.folds).length + Object.keys(this.lemmas).length > 0; }
+    atKey(k) {
         const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
-        const at = (k) => {
-            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x, this.p())));
-            const below = [...this.kind.invariant(x), ...steps];
-            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k, this.p()))))] : []));
-        };
-        const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
-        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(fromOf(d, this.p()))), ...(any ? [everyKey(at)] : [])];
+        const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x, this.p())));
+        const below = [...this.kind.invariant(x), ...steps];
+        return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k, this.p()))))] : []));
     }
     // Whether a fold reads the params (its start a function, or its step taking them).
     get readsParams() { return Object.values(this.folds).some(d => typeof d.from === 'function' || d.step.length > 2); }
@@ -1704,11 +1742,15 @@ export class Rule {
         return typeof spec.helpful === 'function' ? { ...base, request: req(spec.helpful) } : { ...base, helpful: spec.helpful.map(h => ({ ...(h.when ? { when: h.when(env).c } : {}), request: req(h.request) })) };
     }
     // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state; the
-    // functions' facts are assumed at the arguments the decision reads them at.
+    // functions' facts are assumed at the arguments the decision reads them at, and a carried list's equations (each
+    // fold's start, its step and its lemmas) at the list's end, the key before it and every key the decision reads it at.
     decide(name, given, then) {
         const env = this.env({ flags: false, state: false, queries: false });
         const g = given(env), hyps = [...this.kindAssumptions(), ...this.spec.pre.map(f => f(env).c), ...this.spec.assume.map(f => f(env).c), ...(Array.isArray(g) ? g : [g]).map(c => c.c)];
-        const t = then(env).c, goal = { name, hyps: [...hyps, { op: 'not', x: t }] };
+        const t = then(env).c;
+        const lists = (this.spec.lists2 ?? []).map(([n]) => env[n]);
+        const listed = lists.flatMap(l => l.equationsAt(uniqueTerms([l.len, l.len.minus(1), ...keysRead([...hyps, t], l.maps)])).map(c => c.c));
+        const goal = { name, hyps: [...listed, ...hyps, { op: 'not', x: t }] };
         const facts = this.spec.fns?.length || this.spec.facts?.length ? factsFor(this.machine, goal) : [];
         return withSource({ name, rule: this, given: hyps, then: t, goal: { name, hyps: [...facts, ...goal.hyps] } }, { decision: { given: given, then: then, own: Array.isArray(g) ? g.length : 1 } });
     }
@@ -2349,7 +2391,9 @@ export function crossCheckDecision(d, opts = {}) {
     let checked = 0;
     for (let i = 0; i < (opts.trials ?? 500); i++) {
         const ps = r.randomParams(rand, bound), input = r.randomInput(rand, bound, ps), values = { ...ps, ...numbersOf(input) };
-        const st = { scalars: {}, maps: Object.fromEntries(Object.entries(input).filter((e) => typeof e[1] !== 'number').map(([n, cells]) => [n, new Map(cells)])) };
+        // a map a request carries reads 0 past its cells (a list's encoding keeps no 0 cell)
+        const carried = Object.entries(input).filter((e) => typeof e[1] !== 'number');
+        const st = { scalars: {}, maps: Object.fromEntries(carried.map(([n, cells]) => [n, new Map(cells)])), defaults: Object.fromEntries(carried.map(([n]) => [n, 0])) };
         const keys = exactKeys(keysOf(bound, st), values, st);
         const sc = { vars: values, maps: Object.fromEntries(Object.entries(st.maps).map(([n, cells]) => [n, { cells, dflt: 0 }])), keys, flags: {} };
         const [g, t] = inScope(sc, () => { const env = r['env']({ flags: false, state: false, queries: false }), g = src.given(env); return [all(...(Array.isArray(g) ? g : [g])).ok, src.then(env).ok]; });

package/dist/core/machine.js

@@ -364,6 +364,30 @@ export function interpret(m) {
 // The same machine as JavaScript source: what an app ships. A step reads the state it was given (every query, flag,
 // scalar, key and value first), then writes the maps and the records in place, so it costs the same however large they
 // grow; the state passed in is consumed. fork copies a state to branch from.
+// The runtime's helpers: a compiled module declares the ones it calls (and the ones those call), no others.
+const RUNTIME = [
+    ['$n', `function $n(v, what) { if (typeof v !== 'number' || !Number.isSafeInteger(v) || v < 0) throw new RangeError(what + ' must be a natural below 2^53, not ' + v); return v; }`],
+    ['$x', `function $x(v) { if (v > 9007199254740991) throw new RangeError('a value passed 2^53 - 1, past which the proofs over the naturals no longer describe the run'); return v; }`],
+    ['$m', `function $m(v, what) { if (!(v instanceof Map)) throw new RangeError(what + ' must be a Map of naturals'); for (const [key, x] of v) { $n(key, 'a key of ' + what); $n(x, 'a cell of ' + what); } return v; }`],
+    ['$keys', `function $keys(maps, names) { const keys = new Set(); let past = 0; for (const c of Object.values(maps)) for (const key of c.keys()) past = Math.max(past, key + 1); for (const n of names) for (const key of maps[n].keys()) keys.add(key); return [...keys, past]; }`],
+    ['$breaks', `function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }`],
+    ['$spread', `function $spread(keys, n) { const out = new Set(); for (const k of keys) for (let i = 0; i < n; i++) out.add(k + i); return [...out].sort((a, b) => a - b); }`],
+    ['$dense', `function $dense(keys, f) { const top = keys[keys.length - 1]; if (top > 1000000) throw new RangeError('a write at every key reads its key in arithmetic past a million keys (' + top + ')'); const d = f(top), cells = new Map(); for (let k = 0; k < top; k++) { const v = f(k); if (v !== d) cells.set(k, v); } return {cells, d}; }`],
+    ['$every', `function $every(keys, f) { const past = keys[keys.length - 1], d = f(past), cells = new Map(); for (let i = 0; i < keys.length - 1; i++) { const v = f(keys[i]); if (v !== d) cells.set(keys[i], v); } return {cells, d}; }`],
+];
+function runtimeFor(code) {
+    const used = new Set();
+    for (let grew = true; grew;) {
+        grew = false;
+        const text = code + RUNTIME.filter(([name]) => used.has(name)).map(([, src]) => src).join('');
+        for (const [name] of RUNTIME)
+            if (!used.has(name) && text.includes(`${name}(`)) {
+                used.add(name);
+                grew = true;
+            }
+    }
+    return RUNTIME.filter(([name]) => used.has(name)).map(([, src]) => `${src}\n`).join('');
+}
 export function compileJs(m) {
     const { h, plain, queries, carried } = runnable(m);
     const id = (name) => JSON.stringify(name);
@@ -451,16 +475,8 @@ export function compileJs(m) {
         'if (head > 1024 && 2 * head > records.length) { records.splice(0, head); head = 0; }', `return {scalars, maps: state.maps, history: records, head${h.prune ? ', last: order' : ''}};`);
     else
         lines.push('return Object.keys(dft).length ? {scalars, maps: state.maps, defaults: dft} : {scalars, maps: state.maps};');
-    return `// Generated from the machine ${m.name}. step consumes its state: keep the one it returns (fork to branch).
-function $n(v, what) { if (typeof v !== 'number' || !Number.isSafeInteger(v) || v < 0) throw new RangeError(what + ' must be a natural below 2^53, not ' + v); return v; }
-function $x(v) { if (v > 9007199254740991) throw new RangeError('a value passed 2^53 - 1, past which the proofs over the naturals no longer describe the run'); return v; }
-function $m(v, what) { if (!(v instanceof Map)) throw new RangeError(what + ' must be a Map of naturals'); for (const [key, x] of v) { $n(key, 'a key of ' + what); $n(x, 'a cell of ' + what); } return v; }
-function $keys(maps, names) { const keys = new Set(); let past = 0; for (const c of Object.values(maps)) for (const key of c.keys()) past = Math.max(past, key + 1); for (const n of names) for (const key of maps[n].keys()) keys.add(key); return [...keys, past]; }
-${fns.map((name, i) => `const fn${i} = (${m.fns[name].js});\n${m.fns[name].call ? `const fnc${i} = (${m.fns[name].call});\n` : ''}`).join('')}function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }
-function $spread(keys, n) { const out = new Set(); for (const k of keys) for (let i = 0; i < n; i++) out.add(k + i); return [...out].sort((a, b) => a - b); }
-function $dense(keys, f) { const top = keys[keys.length - 1]; if (top > 1000000) throw new RangeError('a write at every key reads its key in arithmetic past a million keys (' + top + ')'); const d = f(top), cells = new Map(); for (let k = 0; k < top; k++) { const v = f(k); if (v !== d) cells.set(k, v); } return {cells, d}; }
-function $every(keys, f) { const past = keys[keys.length - 1], d = f(past), cells = new Map(); for (let i = 0; i < keys.length - 1; i++) { const v = f(keys[i]); if (v !== d) cells.set(keys[i], v); } return {cells, d}; }
-export function init(params) {
+    const fnDefs = fns.map((name, i) => `const fn${i} = (${m.fns[name].js});\n${m.fns[name].call ? `const fnc${i} = (${m.fns[name].call});\n` : ''}`).join('');
+    const code = `export function init(params) {
   const env = ${env(false)}, s = {};
   return {scalars: {${Object.entries(plain.state).map(([name, e]) => `${id(name)}: ${ex(e)}`).join(', ')}}, maps: {${Object.keys(plain.maps ?? {}).map(name => `${id(name)}: new Map()`).join(', ')}}${h ? ', history: [], head: 0' : ''}};
 }
@@ -471,6 +487,8 @@ export function step(params, state, input) {
   ${lines.join('\n  ')}
 }
 `;
+    return `// Generated from the machine ${m.name}. step consumes its state: keep the one it returns (fork to branch).
+${runtimeFor(fnDefs + code)}${fnDefs}${code}`;
 }
 // Generated code as a function. Every caller passes source this library generated from its own terms, or a function's
 // `js` the rule's author wrote (code, as the rule itself is), never data; the lint's implied-eval rule is waived here

package/dist/kernel/kernel.js

@@ -1163,12 +1163,14 @@ export function stepLawObligations(machine, laws, instances, sl) {
 // `perStep`: a step law's own instances, where it has them (else `instances`).
 // Each frame's hypotheses read no name a later step's request is read by: the condition the Lean twin's proof needs
 // (Sets.lean's checkSKStep, `avoids (szone s sl)`; plain flags are inlined here, so their names never occur), checked
-// here alike.
+// here alike. A quantified flag's keys are free of it: where the flag is 1 its condition holds at every key, so at a
+// key a later step names too (and the flag, its witness and its condition read none).
+const lawsOnly = (inst) => Object.fromEntries(Object.entries(inst).filter(([n]) => !n.startsWith('?')));
 export function checkStepLaws(m, laws, stepLaws, proof) {
     return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => {
         const inst = proof.perStep?.[sl.name] ?? proof.instances, plain = m.history ? historyMachine(m).machine : m;
         const zone = stepZone(plain, sl.steps ?? 1);
-        return [...assumed(laws, inst), ...assumed(plain.facts ?? [], inst), ...closing(plain, inst)].every(c => !mentions(c, zone))
+        return [...assumed(laws, inst), ...assumed(plain.facts ?? [], inst), ...closing(plain, lawsOnly(inst))].every(c => !mentions(c, zone))
             && stepLawObligations(m, laws, inst, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name]));
     });
 }

package/dist/kernel/prove.js

@@ -665,6 +665,17 @@ const flagInstances = (m, keys, focus = []) => Object.fromEntries(Object.entries
     const n = boundOf(c).length;
     return [[`?${f}`, n === 1 ? keys : focus.length ? related(keys, focus, n).flat() : tuples(keys, n)]];
 }));
+// A k-step law whose steps keep a condition (a flag that holds at one step and is read again at the next) fails at a
+// later step's witness only where the condition held before: so, per quantified flag over one key, the instances at the
+// law's own keys and that flag's witness at every step (a later step's witness is a key an earlier frame may name, as a
+// flag holds at every key: kernel.ts's checkStepLaws). Few instances, where the shared ones are many and mostly idle.
+const keptAcross = (m, laws, inst, own, k) => k < 2 ? [] : Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => {
+    if (c.op !== 'all' || c.keys?.length)
+        return [];
+    const ws = Array.from({ length: k }, (_, i) => ({ op: 'var', name: i ? `w?${f}@${i + 1}` : `w?${f}` })), keys = [...own, ...ws.slice(0, 1)];
+    const keep = new Set(keys.map(e => JSON.stringify(e)));
+    return [Object.fromEntries(Object.entries(inst).map(([n, ks]) => [n, arity(m, laws, n) === 1 ? [...ks.filter(e => keep.has(JSON.stringify(e))), ...(n === `?${f}` ? ws.slice(1) : [])] : ks]))];
+});
 const pairFlags = (m) => Object.values(m.step.flags ?? {}).some(c => c.op === 'all' && !!c.keys?.length);
 // How many keys each instance of a name takes: a law's, or a quantified flag's (?f).
 const arity = (m, laws, n) => {
@@ -677,7 +688,8 @@ const arity = (m, laws, n) => {
 // several keys), the every-key laws and flags at every key they read a map at (a law about several keys at tuples
 // relating `focus`, the goals' own keys).
 function instancesFor(m, laws, build, opts = {}) {
-    let inst = opts.start ?? (opts.seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : opts.seed])), ...flagInstances(m, opts.seed, opts.focus) } : {});
+    const seed = opts.seed && [...new Map(opts.seed.map(e => [JSON.stringify(e), e])).values()];
+    let inst = opts.start ?? (seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : seed])), ...flagInstances(m, seed, opts.focus) } : {});
     const reads = opts.reads ?? (!opts.seed || shifts(m) || laws.some(l => l.keys?.length) || pairFlags(m));
     for (let round = 0; round < 2; round++) {
         if (m.facts?.length)
@@ -703,7 +715,7 @@ const union = (a, b, m) => {
     for (const [n, keys] of Object.entries(b)) {
         const k = arity(m, [], n), groups = (ks) => Array.from({ length: Math.floor(ks.length / k) }, (_, t) => ks.slice(t * k, (t + 1) * k));
         const seen = new Set(groups(out[n] ?? []).map(g => JSON.stringify(g)));
-        out[n] = [...(out[n] ?? []), ...groups(keys).filter(g => !seen.has(JSON.stringify(g))).flat()];
+        out[n] = [...(out[n] ?? []), ...groups(keys).filter(g => !seen.has(JSON.stringify(g)) && !!seen.add(JSON.stringify(g))).flat()];
     }
     return out;
 };
@@ -814,7 +826,8 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     // Each step law its own instances, from its own goal: the keys the step and the laws read, and its own (a k-step
     // law's later frames read keys no other step law has); where positions shift or a law is about several keys, the
     // keys its goal reads a map at too. A frame's hypotheses read no name the run introduces later (kernel.ts's
-    // stepZone), so a k-step law drops the keys that read one.
+    // stepZone), so a k-step law drops the keys that read one; but a flag that holds at every key holds at a later step's
+    // key too: where these instances don't prove it, each flag at its own witness at every step is tried (keptAcross).
     const shared = [...readKeys(plain, laws), ...witnesses(plain)], named = [...laws, ...(plain.facts ?? [])], reads = shifts(plain) || laws.some(l => l.keys?.length) || pairFlags(plain);
     const own = (sl) => [...[sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC),
         ...[sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : []))];
@@ -828,7 +841,17 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     let nodes = base.nodes, leaves = base.leaves;
     for (const sl of stepLaws)
         for (const goal of stepLawObligations(m, laws, perStep[sl.name] ?? instances, sl)) {
-            const out = grow(goal);
+            let out = grow(goal);
+            // A k-step law that reads a condition kept across its steps: each flag at its own witnesses, at every step.
+            if (!('tree' in out))
+                for (const kept of keptAcross(plain, laws, perStep[sl.name] ?? instances, own(sl), sl.steps ?? 1)) {
+                    const again = grow(stepLawObligations(m, laws, kept, sl)[0]);
+                    if ('tree' in again) {
+                        out = again;
+                        perStep[sl.name] = kept;
+                        break;
+                    }
+                }
             if (!('tree' in out))
                 return { proven: false, nodes, leaves, failed: { goal: goal.name, stuck: out.stuck, ...(out.witness ? { witness: out.witness } : {}), ...(out.why ? { why: out.why } : {}) }, checked: false };
             trees[goal.name] = out.tree;