gdp-wired 0.12.5 → 0.12.7

package/README.md

@@ -13,6 +13,9 @@ the laws it must keep. gdp-wired proves them with no proof to write, shows a rea
 npm install gdp-wired   # or bun add gdp-wired; plain JavaScript with types, Node 20+, Bun or a browser
 ```
 
+New to formal verification? [The guide](https://gdpwired.dev/guide) takes a rule from ordinary TypeScript to a proof in
+seven steps, with recipes for limits, workflows, permissions and orders with line items.
+
 ```ts
 import {min, nat, proveRule, rule, when} from 'gdp-wired'
 
@@ -52,7 +55,8 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Invariants**: a law that holds after every sequence of requests ("spend stays within the budget").
 - **Maps, sets and lists of names**: laws at every key ("no day passes its cap"), sets a request carries, conditions
   about every key or every two keys ("a batch is taken only when its values increase"), lists kept in order
-  (`examples/sets.ts`, `examples/lists.ts`, `examples/pairs.ts`).
+  (`examples/sets.ts`, `examples/lists.ts`, `examples/pairs.ts`), and two groups of items with a set each, decided at
+  every pair at once (`examples/groups.ts`).
 - **Step laws**: what one step does ("a balance only goes down", "a grant adds one"), and laws over up to 64 steps in
   a row (`examples/steps.ts`).
 - **Histories**: sums and queries over a log of requests, like a sliding-window rate limit.
@@ -312,7 +316,7 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
 - **Running it**: `rule.interpreter()` is persistent (searches branch from any state); `rule.compiled()` is what an app
   ships: maps and the log updated in place, so a step costs the same however long the history. Both refuse params and
   inputs that aren't naturals below 2^53 and any value past 2^53 − 1, where the proofs over the naturals stop describing
-  the run. The GPU searches refuse a space whose values could pass 2^32 − 1.
+  the run, and a request that fails the rule's `assume` (no proof covers the step it would take). The GPU searches refuse a space whose values could pass 2^32 − 1.
 
 ## Numbers
 
@@ -351,7 +355,7 @@ Proving and checking: a law over 64 steps proves in about 5 s, and Lean checks i
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 64 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `guide.ts` (the guide's code), `groups.ts` (two groups decided at every pair), `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 64 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |
@@ -379,7 +383,7 @@ bun test core/compile.test.ts core/runtime.test.ts kernel/history.test.ts
 cd kernel && bun run-kernel.ts && bun test kernel.test.ts
 ```
 
-The whole suite (159 jobs, about 6 minutes of wall time and 22 minutes of job time) runs on [Modal](https://modal.com):
+The whole suite (163 jobs, about 10 minutes of wall time and 46 minutes of job time) runs on [Modal](https://modal.com):
 
 ```sh
 modal run modal/run.py --jobs modal/suite.json --out runs/modal/suite && sh modal/reap.sh

package/dist/core/dsl.d.ts

@@ -39,7 +39,8 @@ export declare function when(c: Cond, then: TermLike, otherwise: TermLike): Term
 export declare function when(c: Cond, then: Decimal, otherwise: Decimal | number): Decimal;
 export declare function when(c: Cond, then: Decimal | number, otherwise: Decimal): Decimal;
 export declare function when(c: Cond, then: IntLike, otherwise: IntLike): Int;
-export declare function when<K extends string>(c: Cond, then: Choice<K>, otherwise: Choice<K>): Choice<K>;
+export declare function when<K extends string>(c: Cond, then: Choice<K> | NoInfer<K>, otherwise: Choice<K>): Choice<K>;
+export declare function when<K extends string>(c: Cond, then: Choice<K>, otherwise: Choice<K> | NoInfer<K>): Choice<K>;
 export declare function when(c: Cond, then: Str, otherwise: Str): Str;
 export declare function when<V>(c: Cond, then: Maybe<V>, otherwise: Maybe<V>): Maybe<V>;
 export declare function when(c: Cond, then: Cond, otherwise: Cond): Cond;
@@ -129,6 +130,8 @@ export declare class Choice<K extends string> {
     readonly values: readonly K[];
     constructor(n: Term, values: readonly K[]);
     is(k: K): Cond;
+    of(k: K): Choice<K>;
+    private index;
     match(cases: {
         [k in K]: () => Cond;
     }): Cond;
@@ -574,20 +577,10 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     private verdict;
     private crossStep;
     compare<St extends Record<string, Raw>>(reference: {
-        init: (params: {
-            [k in keyof P]: Raw;
-        }) => St;
-        step: (params: {
-            [k in keyof P]: Raw;
-        }, st: St, request: {
-            [k in keyof I]: Raw;
-        }) => St;
-    }, opts?: Draws<{
-        [k in keyof I]: Raw;
-    }> & {
-        params?: (rand: Rand) => {
-            [k in keyof P]: Raw;
-        };
+        init(params: Value<P>): St;
+        step(params: Value<P>, st: St, request: RawInputs<I>): St;
+    }, opts?: Draws<RawInputs<I>> & {
+        params?: (rand: Rand) => Value<P>;
         depth?: number;
     }): Agreement;
     encodeParams(values: {
@@ -662,6 +655,9 @@ type CaseRaw<C extends Cases, T extends string = 'tag'> = {
 type Value<T> = {
     [k in keyof T]: ValueOf<T[k]>;
 };
+type RawInputs<T> = {
+    [k in keyof T]: T[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : T[k] extends CarriedList<infer V, infer _F> ? readonly ValueOf<V>[] : ValueOf<T[k]>;
+};
 type Field = Term | Cond | Int | Decimal | Choice<string> | Str | Variant<any, any> | Maybe<any> | {
     [f: string]: Field | number;
 };
@@ -682,16 +678,8 @@ export declare class Fun<P extends Obj = {}, I extends Obj = {}, O extends Obj =
     private result;
     law(name: string, given: (env: P & I, out: O) => Cond | Cond[], then: (out: O, env: P & I) => Cond): Decision;
     relate(name: string, given: (a: P & I, b: P & I) => Cond | Cond[], then: (outA: O, outB: O, a: P & I, b: P & I) => Cond): Decision;
-    compare(reference: (values: {
-        [k in keyof I]: Raw;
-    }, params: {
-        [k in keyof P]: Raw;
-    }) => Partial<Value<O>>, opts?: Draws<{
-        [k in keyof I]: Raw;
-    }> & {
-        params?: {
-            [k in keyof P]: Raw;
-        };
+    compare(reference: (values: Value<I>, params: Value<P>) => Partial<Value<O>>, opts?: Draws<Value<I>> & {
+        params?: Value<P>;
     }): Agreement;
     get rule(): Rule<P, I>;
     private compiledRule?;
@@ -756,6 +744,10 @@ export type Verdict = {
     witness?: Record<string, number>;
     why?: string;
     trees?: Record<string, Tree>;
+    run?: {
+        params: Record<string, number>;
+        trace: Record<string, unknown>[];
+    };
 };
 export declare class Unproven extends Error {
     readonly verdict: Verdict;

package/dist/core/dsl.js

@@ -94,6 +94,11 @@ export function when(c, then, otherwise) {
             throw new Error('when: records of other fields');
         return Object.fromEntries(Object.keys(then).map(f => [f, when(c, then[f], otherwise[f])]));
     }
+    // A choice's name beside a choice is that choice's value: when(closing, 'closed', status).
+    if (then instanceof Choice && typeof otherwise === 'string')
+        return when(c, then, then.of(otherwise));
+    if (typeof then === 'string' && otherwise instanceof Choice)
+        return when(c, otherwise.of(then), otherwise);
     if (then instanceof Choice && otherwise instanceof Choice)
         return new Choice(when(c, then.n, otherwise.n), then.values);
     if (then instanceof Str && otherwise instanceof Str)
@@ -348,11 +353,14 @@ export class Choice {
         this.n = n;
         this.values = values;
     }
-    is(k) {
+    is(k) { return this.n.eq(this.index(k)); }
+    // The value named k, of this choice's kind (to write: when(c, status.of('closed'), status)).
+    of(k) { return new Choice(lit(this.index(k)), this.values); }
+    index(k) {
         const i = this.values.indexOf(k);
         if (i < 0)
             throw new Error(`${k} is not one of ${this.values.join(', ')}`);
-        return this.n.eq(i);
+        return i;
     }
     match(cases) {
         const results = this.values.map(k => [k, cases[k]()]);
@@ -2118,7 +2126,7 @@ export class Rule {
     // with requests drawn by their kinds (or `draw`), must hold the same values as the compiled rule (decoded: integers and
     // decimals as numbers) for every field the reference's state has, after every step of `trials` runs of `depth`.
     compare(reference, opts = {}) {
-        const s = this.spec, rand = opts.rand ?? seeded(5), bound = opts.bound ?? 100, gen = this.compiled();
+        const s = this.spec, rand = opts.rand ?? seeded(5), bound = opts.bound ?? 100, gen = this.compiled(), run = interpret(this.machine);
         let checked = 0;
         const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
         for (let trial = 0; trial < (opts.trials ?? 200); trial++) {
@@ -2126,8 +2134,11 @@ export class Rule {
             let ours = gen.init(ps), theirs = reference.init(params);
             const edges = trial === 0 ? opts.edges ?? [] : [];
             for (let d = 0; d < (opts.depth ?? 10) + edges.length; d++) {
-                const request = edges[d] ?? opts.draw?.(rand) ?? sample(s.inputs);
-                ours = gen.step(ps, ours, this.encodeInput(request, params));
+                const request = edges[d] ?? opts.draw?.(rand) ?? sample(s.inputs), encoded = this.encodeInput(request, params);
+                // A request the rule's assumption refuses is no step of the rule: the runtimes throw, so it isn't compared.
+                if (!allowed(this.machine, run, ps, ours, encoded))
+                    continue;
+                ours = gen.step(ps, ours, encoded);
                 theirs = reference.step(params, theirs, request);
                 const got = this.decode(ours);
                 for (const [field, want] of Object.entries(theirs)) {
@@ -2377,11 +2388,62 @@ const goalsVerdict = (goals) => {
 };
 // The kinds' laws first, those the caller didn't pass already (by name).
 const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.name === k.name)), ...laws];
+// A real run from the start that breaks a law or a step law, from a few random runs (each request drawn by its kinds,
+// those the rule's assumption refuses skipped): a false law is refused at once, with the run, where the symbolic search
+// would have to decide every case of its goal to reach one. Nothing here is trusted; a run it finds is a run the
+// interpreter took. A rule that reads functions is skipped: the kernel knows them only by their facts (a recurrence's
+// induction machine reads the function it proves things about), so a run computing them proves nothing about the goal.
+const refuteBudget = { trials: 60, depth: 6, bound: 3, ms: 150 };
+function refuteByRuns(r, laws, stepLaws = []) {
+    const m = r.machine;
+    if (Object.keys(m.fns ?? {}).length || m.facts?.length)
+        return undefined;
+    const run = interpret(m), rand = seeded(13), until = performance.now() + refuteBudget.ms, bound = refuteBudget.bound;
+    const shown = (input) => Object.fromEntries(Object.entries(input).map(([n, x]) => [n, typeof x === 'number' ? x : Object.fromEntries(x)]));
+    try {
+        for (let trial = 0; trial < refuteBudget.trials && performance.now() < until; trial++) {
+            const params = r.randomParams(rand, bound);
+            if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
+                continue;
+            const watching = [...laws, ...stepLaws].map(w => ({ w, on: watch(m, run, w, params, bound) }));
+            let st = run.init(params);
+            const trace = [];
+            // The witness: the params, the state the breaking step starts from (or the start) and its request's own values.
+            const broken = (w, at, before, input) => ({ goal: `${w.name} ${at}`, witness: { ...params, ...before.scalars, ...(input ? numbersOf(input) : {}) }, run: { params, trace: trace.map(shown) } });
+            for (const { w, on } of watching)
+                if (!('then' in w) && !on.start(st))
+                    return broken(w, '@start', st);
+            for (let d = 0, tries = 0; d < refuteBudget.depth && tries < 40; tries++) {
+                const input = r.randomInput(rand, bound, params);
+                if (!allowed(m, run, params, st, input))
+                    continue;
+                d++;
+                const next = run.step(params, st, input);
+                trace.push(input);
+                for (const { w, on } of watching)
+                    if (!on.step(st, input, next))
+                        return broken(w, !('then' in w) ? '@step' : (w.steps ?? 1) > 1 ? `@${w.steps} steps` : '@step law', st, input);
+                st = next;
+            }
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+const refutedVerdict = (out) => ({ proven: false, checked: false, goal: out.goal, stuck: 'sat', witness: out.witness, run: out.run });
 export function proveRule(r, laws) {
+    const refuted = refuteByRuns(r, laws);
+    if (refuted)
+        return refutedVerdict(refuted);
     const out = proveLaws(r.machine, withKinds(r, laws));
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveSteps(r, laws, stepLaws) {
+    const refuted = refuteByRuns(r, laws, stepLaws);
+    if (refuted)
+        return refutedVerdict(refuted);
     const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }

package/dist/core/machine.js

@@ -272,6 +272,9 @@ export function carriedView(m, st, input, rename = map => map) {
 }
 // A request's numbers (its inputs), without the maps it carries.
 export const numbersOf = (input) => Object.fromEntries(Object.entries(input).filter((e) => typeof e[1] === 'number'));
+// A request the rule's assumption refuses: the proofs say nothing about the step it would take, so neither runtime takes
+// it (a caller that may send one checks first, as gdp-wired/gdp's gate does).
+const refused = (m) => `${m.name}: the request fails the rule's assumption, so no proof covers the step it would take`;
 // The interpreter: persistent (a step leaves the state it was given as it was), so searches can branch from any state.
 export function interpret(m) {
     const { h, plain, carried } = runnable(m);
@@ -340,6 +343,8 @@ export function interpret(m) {
             }
             for (const [name, c] of Object.entries(plain.step.flags ?? {}))
                 env[`?${name}`] = evalC(c, env, st, plain) ? 1 : 0;
+            if (m.assume && !evalC(m.assume, env, st, plain))
+                throw new RangeError(refused(m));
             const scalars = { ...st.scalars };
             for (const [name, e] of Object.entries(plain.step.state ?? {}))
                 scalars[name] = evalE(e, env, st, plain);
@@ -371,6 +376,8 @@ const RUNTIME = [
     ['$m', `function $m(v, what) { if (!(v instanceof Map)) throw new RangeError(what + ' must be a Map of naturals'); for (const [key, x] of v) { $n(key, 'a key of ' + what); $n(x, 'a cell of ' + what); } return v; }`],
     ['$keys', `function $keys(maps, names) { const keys = new Set(); let past = 0; for (const c of Object.values(maps)) for (const key of c.keys()) past = Math.max(past, key + 1); for (const n of names) for (const key of maps[n].keys()) keys.add(key); return [...keys, past]; }`],
     ['$breaks', `function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }`],
+    // A condition at every two keys that holds wherever x(k) differs from y(k1): only the pairs whose values match are read.
+    ['$join', `function $join(ks, x, y, f) { const by = new Map(); for (const k1 of ks) { const v = y(k1), l = by.get(v); if (l) l.push(k1); else by.set(v, [k1]); } return ks.every(k => { const l = by.get(x(k)); return l === undefined || l.every(k1 => f(k, k1)); }); }`],
     ['$spread', `function $spread(keys, n) { const out = new Set(); for (const k of keys) for (let i = 0; i < n; i++) out.add(k + i); return [...out].sort((a, b) => a - b); }`],
     ['$dense', `function $dense(keys, f) { const top = keys[keys.length - 1]; if (top > 1000000) throw new RangeError('a write at every key reads its key in arithmetic past a million keys (' + top + ')'); const d = f(top), cells = new Map(); for (let k = 0; k < top; k++) { const v = f(k); if (v !== d) cells.set(k, v); } return {cells, d}; }`],
     ['$every', `function $every(keys, f) { const past = keys[keys.length - 1], d = f(past), cells = new Map(); for (let i = 0; i < keys.length - 1; i++) { const v = f(keys[i]); if (v !== d) cells.set(keys[i], v); } return {cells, d}; }`],
@@ -388,6 +395,22 @@ function runtimeFor(code) {
     }
     return RUNTIME.filter(([name]) => used.has(name)).map(([, src]) => `${src}\n`).join('');
 }
+// A condition over two keys, k and k1, that holds wherever a term of k alone differs from a term of k1 alone: an
+// implication (a not-and, or an or with one) whose premises include x(k) = y(k1). The runtime then reads only the pairs
+// whose values match ($join), the rest holding by the premise: rows plus matches, not rows squared.
+function joinOf(c, k, k1) {
+    const reads = (t, key) => JSON.stringify(t).includes(`"op":"var","name":${JSON.stringify(key)}`);
+    const premises = c.op === 'not' && c.x.op === 'and' ? c.x.xs : c.op === 'or' ? c.xs.flatMap(x => (x.op === 'not' ? (x.x.op === 'and' ? x.x.xs : [x.x]) : [])) : [];
+    for (const p of premises) {
+        if (p.op !== '=')
+            continue;
+        if (reads(p.a, k) && !reads(p.a, k1) && reads(p.b, k1) && !reads(p.b, k))
+            return { x: p.a, y: p.b };
+        if (reads(p.b, k) && !reads(p.b, k1) && reads(p.a, k1) && !reads(p.a, k))
+            return { x: p.b, y: p.a };
+    }
+    return undefined;
+}
 export function compileJs(m) {
     const { h, plain, queries, carried } = runnable(m);
     const id = (name) => JSON.stringify(name);
@@ -427,6 +450,15 @@ export function compileJs(m) {
                 bound = { ...bound, ...Object.fromEntries(names.map((n, i) => [n, ks[i]])) };
                 const body = cx(c.c);
                 bound = outer;
+                if (names.length === 2) {
+                    const j = joinOf(c.c, names[0], names[1]);
+                    if (j) {
+                        bound = { ...bound, [names[0]]: 'k', [names[1]]: 'k1' };
+                        const x = ex(j.x), y = ex(j.y);
+                        bound = outer;
+                        return `$join(${keys}, k => ${x}, k1 => ${y}, (k, k1) => ${body})`;
+                    }
+                }
                 return names.length === 1 ? `${keys}.every(k => ${body})` : `(ks => ${ks.map(k => `ks.every(${k} => `).join('')}${body}${')'.repeat(ks.length)})(${keys})`;
             }
         }
@@ -465,7 +497,9 @@ export function compileJs(m) {
         }
         lines.push(`let ${queries.map((_, i) => `q${i} = 0`).join(', ')};`, `for (let i = head; i < records.length; i++) { const r = records[i]; ${queries.map((q, i) => `q${i} = $x(q${i} + ${ex(h.queries[q])});`).join(' ')} }`, ...queries.map((q, i) => `env[${id(q)}] = q${i};`));
     }
-    lines.push(...flags.map((name, i) => `const flag${i} = ${cx(plain.step.flags[name])};`), `const scalars = {...s, ${Object.entries(plain.step.state ?? {}).map(([name, e]) => `${id(name)}: ${ex(e)}`).join(', ')}};`, ...writes.map(([, w], i) => ('each' in w ? `const write${i} = ${every(w)};` : `const key${i} = ${ex(w.key)}, value${i} = ${ex(w.value)};`)));
+    lines.push(...flags.map((name, i) => `const flag${i} = ${cx(plain.step.flags[name])};`), 
+    // The rule's own assumption, as `allowed` (core/watch.ts) reads it (a history's machine assumes more: its relations).
+    ...(m.assume ? [`if (!${cx(m.assume)}) throw new RangeError(${id(refused(m))});`] : []), `const scalars = {...s, ${Object.entries(plain.step.state ?? {}).map(([name, e]) => `${id(name)}: ${ex(e)}`).join(', ')}};`, ...writes.map(([, w], i) => ('each' in w ? `const write${i} = ${every(w)};` : `const key${i} = ${ex(w.key)}, value${i} = ${ex(w.value)};`)));
     if (h)
         lines.push(`const keep = ${cx(h.keep)};`);
     lines.push(...writes.map(([name, w], i) => ('each' in w ? `state.maps[${id(name)}] = write${i}.cells; dft[${id(name)}] = write${i}.d;` : `state.maps[${id(name)}].set(key${i}, value${i});`)));
@@ -727,15 +761,24 @@ function renameKey(lin, from, to) {
 }
 // --- real counterexamples ----------------------------------------------------------------------------------------------
 // Every sequence of up to `depth` requests, with params and inputs within 0..bound, from the start: the first that breaks
-// the law, checked with the interpreter. A law that fails here is false; one that only fails `prove` may just need a
-// stronger invariant.
+// the law, checked with the interpreter. A variable `pre` or `assume` bounds by a constant of at most 15 (a choice, a
+// yes/no, a small upTo) takes every value it may instead. A law that fails here is false; one that only fails `prove` may
+// just need a stronger invariant.
 export function search(m, law, depth = 3, bound = 2) {
     const run = interpret(m);
     const holds = (params, st) => {
         const keys = law.forall ? [...new Set([0, ...Object.values(st.maps).flatMap(cells => [...cells.keys()])])] : [0];
         return keys.every(key => evalC(law.holds, { ...params, ...(law.forall ? { [law.forall]: key } : {}) }, st, m));
     };
-    const tuples = (names) => names.reduce((acc, name) => acc.flatMap(t => Array.from({ length: bound + 1 }, (_, i) => ({ ...t, [name]: i }))), [{}]);
+    const tops = new Map();
+    const conj = (c) => (c === undefined ? [] : c.op === 'and' ? c.xs.flatMap(conj) : [c]);
+    for (const c of [...conj(m.pre), ...conj(m.assume)])
+        if ((c.op === '<' || c.op === '<=') && c.a.op === 'var' && c.b.op === 'const') {
+            const top = c.op === '<' ? c.b.value - 1 : c.b.value;
+            if (top >= 0 && top <= 15)
+                tops.set(c.a.name, Math.min(top, tops.get(c.a.name) ?? top));
+        }
+    const tuples = (names) => names.reduce((acc, name) => acc.flatMap(t => Array.from({ length: (tops.get(name) ?? bound) + 1 }, (_, i) => ({ ...t, [name]: i }))), [{}]);
     const assumed = (env, st) => m.assume === undefined || evalC(m.assume, env, st, m);
     const meetsPre = (params) => m.pre === undefined || evalC(m.pre, params, { scalars: {}, maps: {} }, m);
     for (const params of tuples(m.params)) {

package/dist/kernel/prove.js

@@ -137,9 +137,16 @@ const solveP = (rows, maxRows) => {
     s.rows += rows.length;
     return out;
 };
+// PROVE_TRACE=1 logs each goal grown from its root (hypotheses, nodes, time, outcome) to stderr.
+const proveTrace = !!globalThis.process?.env?.PROVE_TRACE;
 // The budget: 200,000 nodes and, by default, a second per hypothesis (at least 20 seconds) per goal; past either the goal
 // is left `unknown`. A goal with many instances (a law about two keys at its pairs) has that many more rows per leaf.
 export function grow(goal, path = new Map(), budget = { nodes: 0, until: performance.now() + Math.max(20_000, 1_000 * goal.hyps.length) }) {
+    if (proveTrace && !path.size && !budget.nodes) {
+        const t = performance.now(), out = growRoot(goal, path, budget);
+        console.error(`[grow] ${goal.name}: ${goal.hyps.length} hyps, ${budget.nodes} nodes, ${Math.round(performance.now() - t)} ms, ${'tree' in out ? 'proven' : `${out.stuck}${out.why ? ` (${out.why})` : ''}`}`);
+        return out;
+    }
     if (!profile.on || path.size || budget.nodes)
         return growRoot(goal, path, budget);
     const t = performance.now(), s0 = profile.solves, m0 = profile.solveMs, r0 = profile.rowsMs, n0 = profile.nodes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "description": "An automatic prover for stateful rules (budgets, caps, windows, workflows, policies): laws proven with no proof to write, checked again in Lean, counterexamples found on the GPU, the rule shipped as code",
   "keywords": [
     "verification",
@@ -89,7 +89,7 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "smoke": "sh scripts/smoke.sh",
-    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts invoices.test.ts folds.test.ts trees.test.ts pairs.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/trees.ts && bun examples/pairs.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
+    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts invoices.test.ts folds.test.ts trees.test.ts pairs.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/guide.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/trees.ts && bun examples/pairs.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
   },
   "devDependencies": {
     "@gdp-ts/core": "0.1.0",