gdp-wired 0.14.2 → 0.16.0

package/README.md

@@ -69,6 +69,14 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   machine runs as, with each guard and action it names given again in gdp-wired's terms, and `conforms(chart, machine,
   createActor)` drives XState's own actor and the compiled rule with the same random events, comparing every state and
   context; what a chart can't run the same way is refused when built, with the reason (`examples/xstate.ts`).
+- **What nobody stated, looked for when the prover alone stops**: where `proveRule` or `proveSteps` doesn't prove the laws
+  and no run breaks them, it looks for lemmas about the rule's recurrences and lists (`discover`) and then invariants
+  (`inferLaws`), within 10 s (`{search: {ms}}`; `{search: false}`, the prover alone); the verdict's `found` holds what
+  proved them, as laws and lemmas with the source to paste.
+- **Invariants nobody wrote** (`gdp-wired/infer`): `inferLaws(rule, laws)` proves a law that holds but isn't inductive
+  alone, with the laws it finds (bounds, sums and differences over the state, the same where a flag or a choice holds
+  one value, and laws about every key of a map), each proven by the kernel with yours and handed back as the
+  `r.law(...)` call that states it; a false law comes back with the run that breaks it (`examples/infer.ts`).
 - **Orderings at any distance**: "a refund never follows a release", through ghost state that watches the rule.
 - **Liveness**: "every ticket issued is served", in every run that keeps sending the requests that help, including under
   weak fairness (`examples/liveness.ts`).
@@ -78,6 +86,10 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Lemmas you state**: a function defined by a recurrence (`recur`), of one argument or several, reading other
   functions, and lemmas about it proven by induction, at one point or between two, which every rule that reads it may
   then use: a backoff delay is at most 64 at every attempt and never shrinks (`examples/lemmas.ts`).
+- **Lemmas nobody stated** (`gdp-wired/discover`): `discover(rule, laws, stepLaws)` finds what a recurrence or the folds
+  of a list a request carries need, from their values (bounds, linear relations, a closed form of degree 2 at most, a
+  law between two points), proves it by the same induction and keeps only what the laws need; `discoverFold(fold,
+  laws)` does the same for a fold over a tree. What it finds comes back as source to paste (`examples/discover.ts`).
 - **Records and variants**: inputs, state, results, map cells and list items made of named fields, or one of several
   cases each with fields of its own (a payment by card or in cash, a seat free, held or sold), every case covered
   (`examples/datatypes.ts`).
@@ -90,13 +102,13 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   secret never changes the answer". `examples/jev-fabric/` ports a Bend project's policy core and proves all 59 laws its
   Bend proofs state.
 
-When a law is false, the GPU search finds a real run that breaks it. When a law needs an invariant nobody wrote, the GPU
-synthesizer finds one and the kernel proves it.
+When a law is false, the GPU search finds a real run that breaks it. When a law needs an invariant nobody wrote,
+`inferLaws` finds one on the CPU (and the GPU synthesizer, at scale, in `research/synth/`) and the kernel proves it.
 
 **What it leaves to Lean or Bend.** Two things, and neither is a gap the next feature closes: proofs the prover would
-have to invent (induction over a recursive structure whose proof needs a lemma nobody stated, and arithmetic with
-products of unknowns beyond multiplying two known facts; integer arithmetic with induction or with products is
-undecidable; a lemma you state about a recurrence is proven, but a recursive datatype as a value is Lean's), and shipping an arbitrary algorithm as its proved source (gdp-wired ships the rule as JavaScript; Bend
+have to invent (induction over a recursive structure whose proof needs a lemma nobody stated and `discover` doesn't find, and arithmetic with
+products of unknowns beyond what products of facts and sums of squares give; integer arithmetic with induction or
+with products is undecidable; a lemma you state about a recurrence is proven, but a recursive datatype as a value is Lean's), and shipping an arbitrary algorithm as its proved source (gdp-wired ships the rule as JavaScript; Bend
 compiles the proved source itself). The full list of what is and isn't in scope is in
 [`docs/comparison.md`](docs/comparison.md#gdp-wireds-scope-in-detail).
 
@@ -238,6 +250,13 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   `Acct.set(k, value)`, `Acct.each(k => value)`) and `.items({Queue: Job})` (`push`, `pop`, `set`, `insertAt`,
   `removeAt`, `apply`, `has`, `within`, `increasing(by)`), one map per variable of the kind; `rule.decode` reads them back
   as objects and arrays.
+- **Sequences a request carries** (`.carriesSeq('Path')`, and tables of them, `.carriesSeqs('Paths')`): a sequence of
+  naturals as positions and a length, `Path.at(i)`, `Path.len`, a table's row `Paths.row(r)`; `A.prefixOf(B)`,
+  `startsWith`, `equals`, `extends(B, k)`, `has(x)`, each a condition about every position below a length, so laws about
+  prefixes of paths need no induction or lemma. The request gives an array of naturals (interned names), a table an
+  array of them. `everyBelow(n, k => ...)` checks bookkeeping a request carries row by row (where each grant went). A
+  condition about every row of a table can't compare the rows' sequences (that is two keys at once); compare a row at a
+  named row, a witness, instead (`examples/scopes.ts`: pi-fabric's path scopes, covering, attenuation and normalization).
 - **Lists a request carries** (`.carriesList('Lines', Line, folds, lemmas)`): the items one carried map per variable of
   the kind, the length `Lines.len`, each fold (`{total: {from: 0, step: (acc, line) => acc.plus(line.amount)}}`) a
   carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
@@ -276,8 +295,12 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   declared pattern (Cedar's glob), all computed from the string itself when the input is encoded. `s.like(pattern)`,
   `s.eq('admin')` (which carries the literal's length and pattern bits, so laws reason from either), `s.isEmpty`,
   `s.length`; sets of strings are carried maps keyed by `s.id`.
-- **Arithmetic** over the naturals: `plus`, `minus` (truncated), `times(k)`, `mul` (a product of two terms), `min`,
-  `max`, `when(cond, a, b)`, `count(cond)`; conditions `lt`, `atMost`, `eq`, `and`, `or`, `not`, `implies`.
+- **Arithmetic** over the naturals: `plus`, `minus` (truncated), `times(k)`, `mul` (a product of two terms, a map's
+  cell among them: `Used.at(k).atMost(per.mul(Seats.at(k)))`), `min`, `max`, `when(cond, a, b)`, `count(cond)`;
+  conditions `lt`, `atMost`, `eq`, `and`, `or`, `not`, `implies`. Where a law with products isn't linear in its
+  monomials, the prover multiplies facts together and adds squares, as Lean's `nlinarith` does: (x − y)² for each
+  product x·y the law reads, its factors as the step leaves them, and for each monomial split in two halves
+  (Cauchy–Schwarz's (ad − bc)²), times each factor past degree two (`research/frontier/nonlinear.ts`).
 - **Sets and quantifiers**: `.carries(...)` for sets a request brings, `everyKey(k => ...)` (and `has`, `subsetOf`,
   `disjointFrom`, `sameAs`) anywhere in a step or inside a law, `everyKey((i, j) => ...)` in a step for every two keys
   (each read on its own, compared with the other plainly: `i.lt(j)`), `M.each(k => ...)` to write every key, and
@@ -378,12 +401,13 @@ The npm package is built from `core/`, `kernel/` and `lean-kernel/` alone; nothi
 ## Running
 
 The npm package is the library: the builders (`gdp-wired`), the runtimes (`gdp-wired/machine`), composition
-(`gdp-wired/compose`), XState machines as charts (`gdp-wired/xstate`), the Lean export (`gdp-wired/lean`), the kernel
-(`gdp-wired/kernel`), the prover (`gdp-wired/prove`), the derivation checker and solver (`gdp-wired/check`,
-`gdp-wired/solver`). Everything else here (examples, comparisons, the Lean twin, the GPU searches) runs from a clone and
-needs [Bun](https://bun.sh); Lean 4.34.0 for `lean/` and `lean-kernel/`; a WebGPU runtime (Chrome, or Dawn's node
-bindings) for the GPU parts. Releases: bump `version` in `package.json` and push to main;
-`.github/workflows/publish.yml` publishes it with npm provenance.
+(`gdp-wired/compose`), XState machines as charts (`gdp-wired/xstate`), lemmas nobody stated (`gdp-wired/discover`), invariant
+inference (`gdp-wired/infer`), the
+Lean export (`gdp-wired/lean`), the kernel (`gdp-wired/kernel`), the prover (`gdp-wired/prove`), the derivation checker
+and solver (`gdp-wired/check`, `gdp-wired/solver`). Everything else here (examples, comparisons, the Lean twin, the GPU
+searches) runs from a clone and needs [Bun](https://bun.sh); Lean 4.34.0 for `lean/` and `lean-kernel/`; a WebGPU
+runtime (Chrome, or Dawn's node bindings) for the GPU parts. Releases: bump `version` in `package.json` and push to
+main; `.github/workflows/publish.yml` publishes it with npm provenance.
 
 ```sh
 git clone --recursive https://github.com/monotykamary/gdp-wired && cd gdp-wired

package/dist/core/chart.js

@@ -256,9 +256,9 @@ export class Chart {
                     missed.push({ name, law: r.law(`${name} is never reached`, (env) => env[reg.field].is(l).not()) });
             }
         const proven = (v) => v.proven && v.checked;
-        const allMissed = missed.length > 0 && proven(proveRule(r, [...this.chartLaws(), ...missed.map(x => x.law)]));
+        const allMissed = missed.length > 0 && proven(proveRule(r, [...this.chartLaws(), ...missed.map(x => x.law)], { search: false }));
         for (const x of missed)
-            reached[x.name] = allMissed || proven(proveRule(r, [...this.chartLaws(), x.law])) ? 'unreachable' : 'unknown';
+            reached[x.name] = allMissed || proven(proveRule(r, [...this.chartLaws(), x.law], { search: false })) ? 'unreachable' : 'unknown';
         // A way out is a transition to a state: an internal one stays where it is.
         const stuck = regions.flatMap(reg => reg.leaves.filter(l => !reg.finals.has(l) && !placed.some(t => t.to !== undefined && t.region === reg.name && t.sources.includes(l))).map(l => label(reg, l)));
         // Pairs as specific as each other, on one event, from a state they share: proven never both enabled, all at once,
@@ -270,9 +270,9 @@ export class Chart {
             pairs.push({ t, u, law: r.stepLaw(`transitions ${t.order} and ${u.order} on ${t.event} are never both enabled`, (env) => all(env[`on${i}`], env[`on${j}`]).not()) });
         }));
         const ambiguous = [];
-        if (pairs.length && !proven(proveSteps(r, this.chartLaws(), pairs.map(x => x.law))))
+        if (pairs.length && !proven(proveSteps(r, this.chartLaws(), pairs.map(x => x.law), { search: false })))
             for (const { t, u, law } of pairs) {
-                const v = proveSteps(r, this.chartLaws(), [law]);
+                const v = proveSteps(r, this.chartLaws(), [law], { search: false });
                 if (!proven(v))
                     ambiguous.push({ event: t.event, transitions: [t.order, u.order], verdict: v });
             }

package/dist/core/discover.d.ts

@@ -0,0 +1,27 @@
+import { type Law } from './machine.js';
+import { type StepLaw, type Verdict, Rule } from './dsl.js';
+import { type Fold } from '../kernel/kernel.js';
+type Obj = object;
+type AnyRule = Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>;
+export type Found = {
+    lemmas?: string[];
+    between?: string[];
+};
+export type Discovery = {
+    verdict: Verdict;
+    rule: AnyRule;
+    found: Record<string, Found>;
+};
+export declare function discover(r: AnyRule, laws: Law[], stepLaws?: StepLaw[], first?: Verdict): Discovery;
+type TreeFold = {
+    fold: Fold;
+    lemmas?: Law[];
+    name: string;
+};
+export type FoldDiscovery = {
+    verdict: Verdict;
+    lemmas: Law[];
+    found: string[];
+};
+export declare function discoverFold(f: TreeFold, laws: Law[]): FoldDiscovery;
+export {};

package/dist/core/discover.js

@@ -0,0 +1,491 @@
+// Lemmas nobody stated, found: when a rule's laws need a fact about a function defined by a recurrence (`recur`) or
+// about the folds of a list a request carries (`carriesList`) that nobody wrote, `discover` looks for it. Candidates come
+// from the values themselves: the function computed at many points, the folds over many random lists, and every
+// statement of a few shapes that all of them meet (bounds, bounds linear in x, in the further arguments, in the other
+// folds or in the params, a closed form fitted exactly to the values, a polynomial of degree 2 at most, and laws
+// between two points: never shrinks, never grows faster than it did). Those are proven the way stated lemmas are, by
+// induction, together (one that isn't inductive is dropped and the rest tried again: Houdini), and of what is proven
+// only the lemmas the laws need are kept. Nothing here is trusted: what it finds is a lemma like any other, proven by
+// the kernel when the function or the list is made again with it, and exported to Lean the same way.
+//   const out = discover(r, laws, stepLaws)
+//   out.verdict          // the laws, proven of out.rule: r with its functions and lists made again with the lemmas
+//   out.found            // per function or list, the lemmas found, as source to paste into recur(...) or carriesList(...)
+import { any, atMost, compileFunction, evalC, evalE, n, plus, prod, same, times, x } from "./machine.js";
+import { Unproven, lit, proveFold, proveSteps, recur, recurOf } from "./dsl.js";
+const seeded = (seed) => { let s = seed; return (k) => { s = (s * 1103515245 + 12345) % 2 ** 31; return Math.floor(s / 2 ** 31 * k); }; };
+const valueOf = (t) => (typeof t === 'number' ? t : t.val);
+const evalLin = (l, at) => Object.entries(l).reduce((s, [a, c]) => s + c * (a === '1' ? 1 : at[a]), 0);
+const holds = (c, at) => { const v = evalLin(c.lin, at); return c.rel === '=' ? v === 0 : v <= 0; };
+// The statement as a condition over terms, and as source: the atoms with a positive coefficient on one side, the rest on
+// the other (naturals: no subtraction).
+const sides = (l) => {
+    const pos = [], neg = [];
+    for (const [a, c] of Object.entries(l))
+        if (c > 0)
+            pos.push([a, c]);
+        else if (c < 0)
+            neg.push([a, -c]);
+    return { pos, neg };
+};
+const termOfSide = (side, atoms) => {
+    const ts = side.map(([a, c]) => (a === '1' ? lit(c) : c === 1 ? atoms[a] : atoms[a].times(c)));
+    return ts.length ? ts.slice(1).reduce((acc, t) => acc.plus(t), ts[0]) : lit(0);
+};
+const condOf = (c, atoms) => {
+    const { pos, neg } = sides(c.lin), a = termOfSide(pos, atoms), b = termOfSide(neg, atoms);
+    return c.rel === '=' ? a.eq(b) : a.atMost(b);
+};
+const srcOfSide = (side, src) => {
+    const parts = side.filter(([a]) => a !== '1'), k = side.find(([a]) => a === '1')?.[1];
+    if (!parts.length)
+        return String(k ?? 0);
+    const one = ([a, c]) => (c === 1 ? src(a) : `${src(a)}.times(${c})`);
+    return [one(parts[0]), ...parts.slice(1).map(p => `.plus(${one(p)})`), ...(k ? [`.plus(${k})`] : [])].join('');
+};
+// The side that holds the value the lemma is about (f(x), or the fold) goes first: f.atLeast(1), not lit(1).atMost(f).
+const flipped = (c, target) => { const { pos, neg } = sides(c.lin); return neg.some(([a]) => a === target) || (pos.every(([a]) => a === '1') && neg.some(([a]) => a !== '1')); };
+const srcOf = (c, src, target) => {
+    const { pos, neg } = sides(c.lin);
+    if (flipped(c, target))
+        return `${srcOfSide(neg, src)}.${c.rel === '=' ? 'eq' : 'atLeast'}(${srcOfSide(pos, src)})`;
+    return `${srcOfSide(pos, src)}.${c.rel === '=' ? 'eq' : 'atMost'}(${srcOfSide(neg, src)})`;
+};
+// The name a found lemma goes by: the statement in plain arithmetic.
+const nameOf = (c, show, target) => {
+    const { pos, neg } = sides(c.lin);
+    const side = (s) => (s.length ? [...s.filter(([a]) => a === target), ...s.filter(([a]) => a !== target)].map(([a, k]) => (a === '1' ? String(k) : k === 1 ? show(a) : `${k}·${show(a)}`)).join(' + ') : '0');
+    return flipped(c, target) ? `${side(neg)} ${c.rel === '=' ? '=' : '>='} ${side(pos)}` : `${side(pos)} ${c.rel === '=' ? '=' : '<='} ${side(neg)}`;
+};
+// Candidates: `target` against forms built from `bases` (each a scaled atom or nothing) and a fitted constant, kept when
+// the samples hold them. An equality where the upper and lower constant meet.
+function linearCands(target, forms, samples, show) {
+    const out = [];
+    for (const form of forms) {
+        const d = samples.map(s => s[target] - evalLin(form, s)), hi = Math.max(...d), lo = Math.min(...d);
+        const lin = (k, sign) => { const l = { [target]: sign }; for (const [a, c] of Object.entries(form))
+            l[a] = (l[a] ?? 0) - sign * c; if (k)
+            l['1'] = -sign * k; return l; };
+        const constOnly = Object.keys(form).length === 0;
+        if (hi === lo)
+            out.push({ name: '', rel: '=', lin: lin(hi, 1) });
+        else {
+            out.push({ name: '', rel: '<=', lin: lin(hi, 1) });
+            // f >= 0 says nothing; a lower bound against a form only where it is one.
+            if (!(constOnly && lo <= 0))
+                out.push({ name: '', rel: '<=', lin: lin(lo, -1) });
+        }
+    }
+    for (const c of out) {
+        c.name = nameOf(c, show, target);
+        c.target = target;
+    }
+    return dedupe(out.filter(c => samples.every(s => holds(c, s))));
+}
+const dedupe = (cs) => [...new Map(cs.map(c => [c.name, c])).values()];
+// A polynomial in x of degree 2 at most, exact over the rationals, as d·f = a·x·x + b·x + c with whole numbers: fitted to
+// three points, kept when every sample meets it.
+function closedForm(samples, show) {
+    const at = new Map();
+    for (const s of samples) {
+        if (at.has(s.x) && at.get(s.x) !== s.f)
+            return [];
+        at.set(s.x, s.f);
+    }
+    if (![0, 1, 2].every(x => at.has(x)))
+        return [];
+    const [f0, f1, f2] = [at.get(0), at.get(1), at.get(2)];
+    // f = a x² + b x + c: c = f0, a = (f2 - 2 f1 + f0) / 2, b = f1 - f0 - a; times 2 to keep whole numbers.
+    const A = f2 - 2 * f1 + f0, B = 2 * (f1 - f0) - A, C = 2 * f0;
+    if (A === 0)
+        return []; // linear: the bounds find it
+    const g = [A, B, C, 2].reduce((p, q) => gcd(p, Math.abs(q)), 0);
+    const c = { name: '', rel: '=', lin: Object.fromEntries(Object.entries({ f: 2 / g, xx: -A / g, x: -B / g, 1: -C / g }).filter(([, k]) => k !== 0)) };
+    c.name = nameOf(c, show, 'f');
+    return samples.every(s => holds(c, s)) ? [c] : [];
+}
+// The law a goal is of (the kernel names each goal after its law: '<law> @step').
+const lawOfGoal = (goal) => goal.replace(/ @(start|step|step law|\d+ steps|leaf|node)$/, '');
+const isGoalOf = (goal) => (c) => { const law = lawOfGoal(goal); return law === c.name || law === `${c.name} at y`; };
+const gcd = (a, b) => (b === 0 ? Math.abs(a) : gcd(b, a % b));
+// --- recurrences ---------------------------------------------------------------------------------------------------
+const showRecur = (a) => (a === 'f' ? 'f(x)' : a === 'g' ? 'f(y)' : a === 'xx' ? 'x·x' : a);
+const srcRecur = (a) => (a === 'xx' ? 'x.mul(x)' : a);
+// The function's values: x from 0 to 40 at a few values of each further argument (all of them for two at most).
+function recurSamples(d, args) {
+    const f = (typeof d.js === 'function' ? d.js : compileFunction([], `return (${d.js})`)());
+    const vals = [0, 1, 2, 3, 5, 8, 13, 40];
+    const tuples = args.reduce((acc) => acc.flatMap(t => vals.map(v => [...t, v])), [[]]);
+    const out = [];
+    for (const t of tuples)
+        for (let x = 0; x <= 40; x++) {
+            let y;
+            try {
+                y = f(x, ...t);
+            }
+            catch (e) {
+                if (e instanceof RangeError)
+                    break;
+                throw e;
+            }
+            out.push({ x, f: y, xx: x * x, ...Object.fromEntries(args.map((a, i) => [a, t[i]])) });
+        }
+    return out;
+}
+// Lemmas about every x and f(x), and laws between two points, that every value meets.
+function recurCands(samples, args) {
+    const slopes = new Set();
+    const byArgs = new Map();
+    for (const s of samples) {
+        const k = args.map(a => s[a]).join();
+        byArgs.set(k, [...(byArgs.get(k) ?? []), s]);
+    }
+    for (const run of byArgs.values())
+        for (let i = 1; i < run.length; i++) {
+            const dd = run[i].f - run[i - 1].f;
+            if (dd > 0)
+                slopes.add(dd);
+        }
+    // The gentlest slopes and the steepest.
+    const sorted = [...slopes].sort((a, b) => a - b), picked = [...new Set([...sorted.slice(0, 3), ...sorted.slice(-1)])];
+    const xs = [{}, ...picked.map(s => ({ x: s }))];
+    const forms = xs.flatMap(fx => [fx, ...args.map(a => ({ ...fx, [a]: 1 }))]);
+    const lemmas = [...linearCands('f', forms, samples, showRecur), ...(args.length ? [] : closedForm(samples, showRecur))];
+    const pairs = [];
+    for (const run of byArgs.values())
+        for (const a of run)
+            for (const b of run)
+                if (a.x <= b.x)
+                    pairs.push({ x: a.x, f: a.f, y: b.x, g: b.f });
+    const steepest = Math.max(0, ...slopes);
+    const between = [
+        { name: '', rel: '<=', lin: { f: 1, g: -1 } },
+        { name: '', rel: '<=', lin: { g: 1, f: -1 } },
+        ...(steepest ? [{ name: '', rel: '<=', lin: { g: 1, x: steepest, f: -1, y: -steepest } }] : []),
+    ].filter(c => pairs.every(p => holds(c, p)));
+    for (const c of between)
+        c.name = nameOf(c, showRecur, 'g');
+    return { lemmas, between };
+}
+const recurAtoms = (args, x, f, env, y, g) => ({ x, f, xx: x.mul(x), ...(y && g ? { y, g } : {}), ...Object.fromEntries(args.map(a => [a, env[a]])) });
+const recurSrc = (c, args, between) => {
+    const reads = (a) => Object.keys(c.lin).includes(a) || (a === 'x' && 'xx' in c.lin);
+    const names = between ? ['x', 'f', 'y', 'g'] : ['x', 'f'];
+    let unused = 0;
+    const params = [...names.map(n => (reads(n) ? n : '_'.repeat(++unused))), ...(args.some(reads) ? [`{${args.filter(reads).join(', ')}}`] : [])];
+    while (params.length && /^_+$/.test(params.at(-1)))
+        params.pop();
+    return `${quoted(c.name)}: (${params.join(', ')}) => ${srcOf(c, srcRecur, between ? 'g' : 'f')}`;
+};
+// The function made again with the lemmas and laws between, those that aren't proven dropped one at a time.
+function houdiniRecur(d, lemmas, between) {
+    const src = recurOf(d), args = [...(src.def.args ?? [])];
+    let ls = [...lemmas], bs = [...between];
+    for (let round = 0; round < lemmas.length + between.length + 1; round++) {
+        try {
+            const made = recur(src.name, src.def, { ...src.lemmas, ...Object.fromEntries(ls.map(c => [c.name, (x, f, env) => condOf(c, recurAtoms(args, x, f, env))])) }, { ...src.between, ...Object.fromEntries(bs.map(c => [c.name, (x, f, y, g, env) => condOf(c, recurAtoms(args, x, f, env, y, g))])) });
+            return { d: made, lemmas: ls, between: bs };
+        }
+        catch (e) {
+            if (!(e instanceof Unproven))
+                throw e;
+            const goal = e.verdict.goal ?? '', l = ls.find(isGoalOf(goal)), b = bs.find(isGoalOf(goal));
+            if (l)
+                ls = ls.filter(c => c !== l);
+            else if (b)
+                bs = bs.filter(c => c !== b);
+            else if (bs.length)
+                bs = []; // a lemma at y that isn't proven between the points: give up on the laws between
+            else
+                return undefined;
+        }
+    }
+    return undefined;
+}
+const natParams = (params) => params.filter(([n, k]) => { const vs = k.vars(n); return vs.length === 1 && vs[0] === n; }).map(([n]) => n);
+function listSamples([name, kind, folds], params) {
+    const rand = seeded(7), out = [];
+    for (let trial = 0; trial < 300; trial++) {
+        const pv = Object.assign({}, ...params.map(([n, k]) => k.random(n, rand, 12)));
+        const p = Object.fromEntries(params.map(([n, k]) => [n, k.build(n, part => lit(pv[part]))]));
+        const acc = {};
+        for (const [f, d] of Object.entries(folds))
+            acc[f] = typeof d.from === 'number' ? d.from : valueOf(d.from(p));
+        const len = rand(9), at = (i) => ({ ...acc, i, ...pv });
+        out.push(at(0));
+        for (let i = 0; i < len; i++) {
+            const raw = kind.random(name, rand, 12), item = kind.build(name, part => lit(raw[part] ?? 0));
+            for (const [f, d] of Object.entries(folds))
+                acc[f] = valueOf(d.step(lit(acc[f]), item, p));
+            out.push(at(i + 1));
+        }
+    }
+    return out.filter(s => Object.values(s).every(v => v !== undefined && Number.isSafeInteger(v)));
+}
+function listCands(part, params, samples) {
+    const folds = Object.keys(part[2]), ps = natParams(params);
+    // The position reads only as itself (a list's lemmas hold at every position, a condition at every key, which reads its
+    // key alone or plus a constant).
+    const out = [];
+    for (const f of folds) {
+        const others = [...folds.filter(g => g !== f), ...ps];
+        const forms = [{}, { i: 1 }, ...others.map(g => ({ [g]: 1 })), ...others.flatMap((g, j) => others.slice(j + 1).map(h => ({ [g]: 1, [h]: 1 })))];
+        out.push(...linearCands(f, forms, samples, a => a));
+    }
+    return dedupe(out);
+}
+const listSrc = (c, folds, params, target) => {
+    const reads = (a) => a in c.lin;
+    const ps = [`{${folds.filter(reads).join(', ')}}`, ...(reads('i') || params.some(reads) ? [reads('i') ? 'i' : '_'] : []), ...(params.some(reads) ? [`{${params.filter(reads).join(', ')}}`] : [])];
+    return `${quoted(c.name)}: (${ps.join(', ')}) => ${srcOf(c, a => a, target)}`;
+};
+const listLemma = (c, params) => (acc, i, p) => condOf(c, { ...acc, i, ...Object.fromEntries(params.map(n => [n, p[n]])) });
+function houdiniList(r, part, cands, params) {
+    let ls = [...cands];
+    for (let round = 0; round <= cands.length; round++) {
+        try {
+            return { rule: r.withParts({}, { [part[0]]: Object.fromEntries(ls.map(c => [c.name, listLemma(c, params)])) }), kept: ls };
+        }
+        catch (e) {
+            if (!(e instanceof Unproven))
+                throw e;
+            const goal = e.verdict.goal ?? '', l = ls.find(isGoalOf(goal));
+            if (!l)
+                return undefined;
+            ls = ls.filter(c => c !== l);
+        }
+    }
+    return undefined;
+}
+// --- the search ----------------------------------------------------------------------------------------------------
+// The laws of r, and where they aren't proven as r states them, the lemmas found for its functions and lists: all that
+// is proven first, then each dropped in turn while the laws stay proven without it.
+// `first`: the laws' verdict on r alone, when the caller has it.
+export function discover(r, laws, stepLaws = [], first = proveSteps(r, laws, stepLaws, { search: false })) {
+    if (first.proven && first.checked)
+        return { verdict: first, rule: r, found: {} };
+    const { params, fns, lists } = r.parts, ps = natParams(params);
+    // Per function and per list: what is proven, made into the rule.
+    const fnMade = {};
+    for (const [n, d] of fns) {
+        const src = recurOf(d);
+        if (!src)
+            continue;
+        const args = [...(src.def.args ?? [])], { lemmas, between } = recurCands(recurSamples(d, args), args);
+        const made = houdiniRecur(d, lemmas, between);
+        if (made && (made.lemmas.length || made.between.length))
+            fnMade[n] = made;
+    }
+    let rule = r.withParts(Object.fromEntries(Object.entries(fnMade).map(([n, m]) => [n, m.d])));
+    const listKept = {};
+    for (const part of lists) {
+        const out = houdiniList(rule, part, listCands(part, params, listSamples(part, params)), ps);
+        if (out && out.kept.length) {
+            rule = out.rule;
+            listKept[part[0]] = out.kept;
+        }
+    }
+    const verdict = proveSteps(rule, laws, stepLaws, { search: false });
+    const found = () => ({
+        ...Object.fromEntries(Object.entries(fnMade).map(([n, m]) => { const args = [...(recurOf(m.d).def.args ?? [])]; return [n, { ...(m.lemmas.length ? { lemmas: m.lemmas.map(c => recurSrc(c, args, false)) } : {}), ...(m.between.length ? { between: m.between.map(c => recurSrc(c, args, true)) } : {}) }]; })),
+        ...Object.fromEntries(Object.entries(listKept).map(([n, cs]) => [n, { lemmas: cs.map(c => listSrc(c, Object.keys(lists.find(l => l[0] === n)[2]), ps, c.target)) }])),
+    });
+    if (!(verdict.proven && verdict.checked))
+        return { verdict, rule, found: found() };
+    // Only what the laws need: each lemma dropped in turn (the function or list made again without it, which fails when
+    // another lemma leaned on it), kept where the laws aren't proven without it.
+    let best = { rule, verdict };
+    // A rule made again and the laws proven of it; or the lemma whose proof failed without the one dropped.
+    const tryRule = (next) => {
+        try {
+            const r2 = next(), v = proveSteps(r2, laws, stepLaws, { search: false });
+            return v.proven && v.checked ? { rule: r2, verdict: v } : undefined;
+        }
+        catch (e) {
+            if (e instanceof Unproven)
+                return { leaned: e.verdict.goal ?? '' };
+            throw e;
+        }
+    };
+    const original = Object.fromEntries(fns);
+    const fnRecur = (n, m) => {
+        const src = recurOf(original[n]), args = [...(src.def.args ?? [])];
+        return recur(src.name, src.def, { ...src.lemmas, ...Object.fromEntries(m.lemmas.map(c => [c.name, (x, f, env) => condOf(c, recurAtoms(args, x, f, env))])) }, { ...src.between, ...Object.fromEntries(m.between.map(c => [c.name, (x, f, y, g, env) => condOf(c, recurAtoms(args, x, f, env, y, g))])) });
+    };
+    const build = () => r.withParts(Object.fromEntries(Object.entries(fnMade).map(([n, m]) => [n, fnRecur(n, m)])), Object.fromEntries(Object.entries(listKept).map(([n, cs]) => [n, Object.fromEntries(cs.map(c => [c.name, listLemma(c, ps)]))])));
+    for (const [n, m] of Object.entries(fnMade)) {
+        // A lemma dropped takes with it those that leaned on it, each named by the proof that failed without it.
+        for (const kind of ['between', 'lemmas'])
+            for (const c of [...m[kind]]) {
+                if (!m[kind].includes(c))
+                    continue;
+                const before = { lemmas: m.lemmas, between: m.between };
+                m[kind] = m[kind].filter(x => x !== c);
+                for (;;) {
+                    const out = tryRule(build);
+                    if (out && 'rule' in out) {
+                        best = out;
+                        break;
+                    }
+                    const d = out ? [...m.lemmas, ...m.between].find(isGoalOf(out.leaned)) : undefined;
+                    if (!d) {
+                        m.lemmas = before.lemmas;
+                        m.between = before.between;
+                        break;
+                    }
+                    m.lemmas = m.lemmas.filter(x => x !== d);
+                    m.between = m.between.filter(x => x !== d);
+                }
+            }
+        if (!m.lemmas.length && !m.between.length)
+            delete fnMade[n];
+    }
+    for (const [n, cs] of Object.entries(listKept)) {
+        for (const c of [...cs]) {
+            if (!listKept[n].includes(c))
+                continue;
+            const before = listKept[n];
+            listKept[n] = listKept[n].filter(x => x !== c);
+            for (;;) {
+                const out = tryRule(build);
+                if (out && 'rule' in out) {
+                    best = out;
+                    break;
+                }
+                const d = out ? listKept[n].find(isGoalOf(out.leaned)) : undefined;
+                if (!d) {
+                    listKept[n] = before;
+                    break;
+                }
+                listKept[n] = listKept[n].filter(x => x !== d);
+            }
+        }
+        if (!listKept[n].length)
+            delete listKept[n];
+    }
+    const again = tryRule(build), last = again && 'rule' in again ? again : best;
+    return { verdict: last.verdict, rule: last.rule, found: found() };
+}
+function foldSamples(f) {
+    const rand = seeded(11), none = { name: f.name, params: [], inputs: [], state: {}, step: {} }, st = { scalars: {}, maps: {} };
+    const out = [];
+    const draw = (names, ok, env) => {
+        for (let tries = 0; tries < 50; tries++) {
+            const e = { ...env, ...Object.fromEntries(names.map(n => [n, rand(2) ? rand(2) : rand(13)])) };
+            if (!ok || evalC(ok, e, st, none))
+                return e;
+        }
+        return undefined;
+    };
+    for (let trial = 0; trial < 300; trial++) {
+        const ps = draw(f.params, f.pre, {});
+        if (!ps)
+            continue;
+        const tree = (depth) => {
+            const own = draw(f.inputs, f.assume, ps);
+            if (!own)
+                return undefined;
+            if (depth === 0 || rand(4) === 0)
+                return Object.fromEntries(Object.entries(f.leaf).map(([n, e]) => [n, evalE(e, own, st, none)]));
+            const l = tree(depth - 1), r = tree(depth - 1);
+            if (!l || !r)
+                return undefined;
+            const env = { ...own, ...Object.fromEntries(Object.entries(l).map(([n, x]) => [`l_${n}`, x])), ...Object.fromEntries(Object.entries(r).map(([n, x]) => [`r_${n}`, x])) };
+            const vals = Object.fromEntries(Object.entries(f.node).map(([n, e]) => [n, evalE(e, env, st, none)]));
+            out.push({ ...ps, ...vals });
+            return vals;
+        };
+        const top = tree(1 + rand(6));
+        if (top)
+            out.push({ ...ps, ...top });
+    }
+    return out.filter(s => Object.values(s).every(x => Number.isSafeInteger(x)));
+}
+const eOfSide = (side) => {
+    const es = side.map(([a, c]) => { const t = a === '1' ? n(c) : a.includes('*') ? prod(x(a.split('*')[0]), x(a.split('*')[1])) : x(a); return a === '1' || c === 1 ? t : times(c, t); });
+    return es.length ? es.slice(1).reduce((acc, t) => plus(acc, t), es[0]) : n(0);
+};
+const cOfCand = (c) => { const { pos, neg } = sides(c.lin), a = eOfSide(pos), b = eOfSide(neg); return c.rel === '=' ? same(a, b) : atMost(a, b); };
+export function discoverFold(f, laws) {
+    const stated = f.lemmas ?? [], first = proveFold({ fold: f.fold, lemmas: stated }, laws);
+    if (first.proven && first.checked)
+        return { verdict: first, lemmas: [], found: [] };
+    const fold = f.fold, names = Object.keys(fold.leaf), rose = names.includes('kind$'), samples = foldSamples(fold);
+    // The values a law reads (a tree's own, or under .children the running values of the children), each group with the
+    // samples it is claimed of and the guard it is claimed under.
+    const groups = rose
+        ? [{ atoms: names.filter(n => !n.startsWith('kids$') && n !== 'kind$'), at: 0 }, { atoms: names.filter(n => n.startsWith('kids$')), at: 1 }]
+        : [{ atoms: names, at: undefined }];
+    const cands = [];
+    for (const g of groups) {
+        const here = samples.filter(s => g.at === undefined || s['kind$'] === g.at).map(s => ({ ...s, ...Object.fromEntries(g.atoms.flatMap(a => fold.params.map(p => [`${a}*${p}`, s[a] * s[p]]))) }));
+        if (!here.length)
+            continue;
+        for (const t of g.atoms) {
+            const others = [...g.atoms.filter(a => a !== t), ...fold.params];
+            const forms = [{}, ...others.map(o => ({ [o]: 1 })), ...others.flatMap((o, j) => others.slice(j + 1).map(q => ({ [o]: 1, [q]: 1 }))), ...g.atoms.filter(a => a !== t).flatMap(a => fold.params.map(p => ({ [`${a}*${p}`]: 1 })))];
+            const show = (a) => a.replace(/kids\$/g, '').replace('*', '·');
+            // A lemma about the children's running values goes by "the children's ...", apart from the laws about a tree's.
+            for (const c of linearCands(t, forms, here, show))
+                cands.push({ cand: g.at === 1 ? { ...c, name: `the children's ${c.name}` } : c, ...(g.at === undefined ? {} : { at: g.at }) });
+        }
+    }
+    const lawOf = ({ cand, at }) => ({ name: cand.name, holds: at === undefined ? cOfCand(cand) : any(at === 0 ? atMost(n(1), x('kind$')) : same(x('kind$'), n(0)), cOfCand(cand)) });
+    // Houdini: every candidate beside the laws; a candidate whose goal fails is dropped, until the rest are proven.
+    let kept = dedupeBy(cands, c => `${c.at}:${c.cand.name}`);
+    const prove = (ks) => proveFold({ fold, lemmas: [...stated, ...ks.map(lawOf)] }, laws);
+    let verdict = prove(kept);
+    for (let round = 0; round <= cands.length && !(verdict.proven && verdict.checked); round++) {
+        const bad = kept.find(c => isGoalOf(verdict.goal ?? '')(c.cand));
+        if (!bad)
+            break;
+        // The kernel's witness is a counterexample to induction: the leaf or node it names, from children that meet every
+        // law kept. Each candidate its values break goes with the one the goal named.
+        const broken = new Set([bad, ...brokenAt(fold, verdict, kept)]);
+        kept = kept.filter(c => !broken.has(c));
+        verdict = prove(kept);
+    }
+    if (!(verdict.proven && verdict.checked))
+        return { verdict, lemmas: [], found: [] };
+    // Only what the laws need.
+    for (const c of [...kept]) {
+        const v = prove(kept.filter(k => k !== c));
+        if (v.proven && v.checked) {
+            kept = kept.filter(k => k !== c);
+            verdict = v;
+        }
+    }
+    const src = ({ cand, at }) => {
+        const reads = Object.keys(cand.lin).flatMap(a => a.split('*')).filter(a => a !== '1'), own = reads.filter(a => !fold.params.includes(a)), ps = reads.filter(a => fold.params.includes(a));
+        const body = srcOf(cand, a => (a.includes('*') ? `${a.split('*')[0]}.mul(${a.split('*')[1]})` : a).replace(/kids\$/g, ''), cand.target);
+        if (at === 1)
+            return `${quoted(cand.name)}: ({${own.map(a => a.replace('kids$', '')).join(', ')}}${ps.length ? `, {${ps.join(', ')}}` : ''}) => ${body}`;
+        return `f.law(${quoted(cand.name)}, ({${[...own, ...ps].join(', ')}}) => ${body})`;
+    };
+    return { verdict, lemmas: kept.map(lawOf), found: kept.map(src) };
+}
+function brokenAt(fold, v, kept) {
+    const w = v.witness, where = /@(leaf|node)$/.exec(v.goal ?? '')?.[1];
+    // A witness over products (each a variable of its own to the linear refutation) isn't a point of the fold.
+    if (!w || !where || Object.keys(w).some(k => k.includes('*')))
+        return [];
+    const none = { name: fold.name, params: [], inputs: [], state: {}, step: {} }, st = { scalars: {}, maps: {} };
+    const withProducts = (c, at) => ({ ...at, ...Object.fromEntries(Object.keys(c.lin).filter(a => a.includes('*')).map(a => [a, at[a.split('*')[0]] * at[a.split('*')[1]]])) });
+    const meets = (c, at) => (c.at !== undefined && at['kind$'] !== c.at) || holds(c.cand, withProducts(c.cand, at));
+    try {
+        const env = { ...Object.fromEntries([...fold.params, ...fold.inputs, ...Object.keys(fold.leaf).flatMap(k => [`l_${k}`, `r_${k}`])].map(k => [k, 0])), ...w };
+        if ((fold.pre && !evalC(fold.pre, env, st, none)) || (fold.assume && !evalC(fold.assume, env, st, none)))
+            return [];
+        const side = (p) => ({ ...Object.fromEntries(fold.params.map(k => [k, env[k]])), ...Object.fromEntries(Object.keys(fold.leaf).map(k => [k, env[`${p}${k}`]])) });
+        // The children must meet what is kept, or the point isn't one the induction step starts from.
+        if (where === 'node' && !kept.every(c => meets(c, side('l_')) && meets(c, side('r_'))))
+            return [];
+        const vals = Object.fromEntries(Object.entries(where === 'leaf' ? fold.leaf : fold.node).map(([k, e]) => [k, evalE(e, env, st, none)]));
+        const at = { ...Object.fromEntries(fold.params.map(k => [k, env[k]])), ...vals };
+        return kept.filter(c => !meets(c, at));
+    }
+    catch {
+        return [];
+    }
+}
+const quoted = (name) => (name.includes("'") ? JSON.stringify(name) : `'${name}'`);
+const dedupeBy = (xs, key) => [...new Map(xs.map(x => [key(x), x])).values()];