gdp-wired 0.14.2 → 0.16.0

package/dist/core/dsl.d.ts

@@ -299,6 +299,26 @@ export declare class ListRef {
     within(): Forall;
     increasing(): Forall;
 }
+export declare class SeqRef {
+    private readonly map;
+    readonly len: Term;
+    private readonly base?;
+    constructor(map: MapRef, len: Term, base?: Term | undefined);
+    at(i: TermLike): Term;
+    private agree;
+    prefixOf(o: SeqRef): Cond;
+    startsWith(o: SeqRef): Cond;
+    equals(o: SeqRef): Cond;
+    extends(o: SeqRef, by: TermLike): Cond;
+    has(x: TermLike): Cond;
+}
+export declare class SeqTable {
+    readonly name: string;
+    readonly rows: Term;
+    constructor(name: string, rows: Term);
+    row(r: TermLike): SeqRef;
+}
+export declare const everyBelow: (n: TermLike, f: (key: Term) => Cond) => Cond;
 export type PartsWrite = {
     readonly parts: Record<string, MapWrite>;
 };
@@ -440,6 +460,14 @@ export type RecurDef<A extends string, U extends Record<string, FnDef>> = {
 export declare const recur: <const A extends string = never, U extends Record<string, FnDef> = {}>(name: string, def: RecurDef<A, U>, lemmas?: Record<string, (x: Term, fx: Term, env: RecurEnv<A, U>) => Cond>, between?: Record<string, (x: Term, fx: Term, y: Term, fy: Term, env: RecurEnv<A, U>) => Cond>) => FnDef & {
     verdict: Verdict;
 };
+type RecurLemma = (x: Term, fx: Term, env: Record<string, Term>) => Cond;
+type RecurBetween = (x: Term, fx: Term, y: Term, fy: Term, env: Record<string, Term>) => Cond;
+export declare const recurOf: (d: FnDef) => {
+    name: string;
+    def: RecurDef<string, Record<string, FnDef>>;
+    lemmas: Record<string, RecurLemma>;
+    between: Record<string, RecurBetween>;
+} | undefined;
 type Kinds = Record<string, Kind<unknown>>;
 type ValuesOf<K extends Kinds> = {
     [n in keyof K]: K[n] extends Kind<infer V> ? V : never;
@@ -465,6 +493,8 @@ type Spec = {
     nodes?: [string, Kind<unknown>, string[], Record<string, NodeFold<unknown, string>>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
+    seqs?: string[];
+    seqTables?: string[];
     lists2?: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
     fns?: [string, FnDef][];
     facts?: ((env: never) => Record<string, Cond | Forall>)[];
@@ -487,6 +517,12 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     constructor(spec: Spec);
     private with;
     get name(): string;
+    get parts(): {
+        params: [string, Kind<unknown>][];
+        fns: [string, FnDef][];
+        lists: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
+    };
+    withParts(fns: Record<string, FnDef>, listLemmas?: Record<string, Record<string, ListLemma>>): this;
     params<K extends Kinds>(kinds: K): Rule<P & ValuesOf<K>, I, S, M, F, R, Su, Q>;
     inputs<K extends Kinds>(kinds: K): Rule<P, I & ValuesOf<K>, S, M, F, R, Su, Q>;
     state<T extends Record<string, number | ((p: P) => TermLike) | Init<unknown>>>(init: T): Rule<P, I, S & {
@@ -525,6 +561,12 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     carries<const N extends string>(...names: N[]): Rule<P, I & {
         [k in N]: MapRef;
     }, S, M, F, R, Su, Q>;
+    carriesSeq<const N extends string>(...names: N[]): Rule<P, I & {
+        [k in N]: SeqRef;
+    }, S, M, F, R, Su, Q>;
+    carriesSeqs<const N extends string>(...names: N[]): Rule<P, I & {
+        [k in N]: SeqTable;
+    }, S, M, F, R, Su, Q>;
     carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V, P>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term, p: P) => Cond>): Rule<P, I & {
         [k in N]: CarriedList<V, Fd>;
     }, S, M, F, R, Su, Q>;
@@ -590,7 +632,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
         [k in keyof P]: Raw;
     }): Record<string, number>;
     encodeInput(values: {
-        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
+        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends SeqRef ? readonly number[] : I[k] extends SeqTable ? readonly (readonly number[])[] : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
     }, params?: {
         [k in keyof P]: Raw;
     }): Request;
@@ -639,6 +681,10 @@ export type Decision = {
     given: C[];
     then: C;
     goal: Goal;
+    steps?: {
+        rule: Rule<Obj>;
+        law: StepLaw;
+    };
 };
 type ResultOf<V> = 0 extends 1 & V ? Term : [V] extends [Cond] ? Cond : [V] extends [Decimal] ? Decimal : [V] extends [Int] ? Int : [V] extends [Choice<infer K>] ? Choice<K> : [V] extends [Str] ? Str : [V] extends [Variant<infer C, infer T>] ? Variant<C, T> : [V] extends [Maybe<infer W>] ? Maybe<ResultOf<W>> : [V] extends [Term | number] ? Term : [V] extends [Record<string, unknown>] ? {
     [f in keyof V]: ResultOf<V[f]>;
@@ -660,7 +706,7 @@ type Value<T> = {
     [k in keyof T]: ValueOf<T[k]>;
 };
 type RawInputs<T> = {
-    [k in keyof T]: T[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : T[k] extends CarriedList<infer V, infer _F> ? readonly ValueOf<V>[] : ValueOf<T[k]>;
+    [k in keyof T]: T[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : T[k] extends SeqRef ? readonly number[] : T[k] extends SeqTable ? readonly (readonly number[])[] : T[k] extends CarriedList<infer V, infer _F> ? readonly ValueOf<V>[] : ValueOf<T[k]>;
 };
 type Field = Term | Cond | Int | Decimal | Choice<string> | Str | Variant<any, any> | Maybe<any> | {
     [f: string]: Field | number;
@@ -752,13 +798,30 @@ export type Verdict = {
         params: Record<string, number>;
         trace: Record<string, unknown>[];
     };
+    found?: Found;
+};
+export type Found = {
+    laws?: {
+        law: Law;
+        text: string;
+        source?: string;
+    }[];
+    lemmas?: Record<string, {
+        lemmas?: string[];
+        between?: string[];
+    }>;
+};
+export type ProveOptions = {
+    search?: boolean | {
+        ms?: number;
+    };
 };
 export declare class Unproven extends Error {
     readonly verdict: Verdict;
     constructor(what: string, verdict: Verdict);
 }
-export declare function proveRule(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[]): Verdict;
-export declare function proveSteps(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], stepLaws: StepLaw[]): Verdict;
+export declare function proveRule(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], opts?: ProveOptions): Verdict;
+export declare function proveSteps(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], stepLaws: StepLaw[], opts?: ProveOptions): Verdict;
 export type { StepLaw };
 export type { Liveness };
 export declare function proveLeadsTo(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], l: Liveness): Verdict;

package/dist/core/dsl.js

@@ -19,6 +19,8 @@ import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersO
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
 import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
+import { discover } from "./discover.js";
+import { inferLaws } from "./infer.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
     if (!Number.isSafeInteger(v) || v < 0)
@@ -860,6 +862,43 @@ export class ListRef {
     within() { return forall(k => this.len.atMost(k).implies(this.at(k).eq(0))); }
     increasing() { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(this.at(i).lt(this.at(j)))); }
 }
+// A sequence of naturals as positions and a length (a path's segments, as interned names): `at(i)` its value at i,
+// `len` its length. Comparing two is a condition about every position below a length (the array property fragment,
+// decidable), so a law about prefixes needs no induction. One a request carries (`carriesSeq`), or a row of a table of
+// them (`carriesSeqs`), its positions read from its row's offset in the table's one map.
+export class SeqRef {
+    map;
+    len;
+    base;
+    constructor(map, len, base) {
+        this.map = map;
+        this.len = len;
+        this.base = base;
+    }
+    at(i) { return this.map.at(!this.base ? i : typeof i === 'number' ? this.base.plus(i) : i.plus(this.base)); }
+    // The same values at every position below `upTo` (both have them).
+    agree(o, upTo) { return everyKey(k => k.lt(upTo).implies(this.at(k).eq(o.at(k)))); }
+    // This one is where o starts; o is where this one starts; the same; o followed by `by` more; x at some position.
+    prefixOf(o) { return this.len.atMost(o.len).and(this.agree(o, this.len)); }
+    startsWith(o) { return o.prefixOf(this); }
+    equals(o) { return this.len.eq(o.len).and(this.agree(o, this.len)); }
+    extends(o, by) { return o.prefixOf(this).and(this.len.eq(o.len.plus(by))); }
+    has(x) { return everyKey(k => k.lt(this.len).implies(this.at(k).ne(x))).not(); }
+}
+// A table of sequences a request carries (each grant's path, say): `row(r)` is row r's sequence, `rows` how many. Rows
+// are read by their number as a map's key, so a condition about every row reads a row only there (`everyBelow(T.rows,
+// r => ...)`).
+export class SeqTable {
+    name;
+    rows;
+    constructor(name, rows) {
+        this.name = name;
+        this.rows = rows;
+    }
+    row(r) { return new SeqRef(new MapRef(this.name, 0), new MapRef(`${this.name}_len`, 0).at(r), new MapRef(`${this.name}_base`, 0).at(r)); }
+}
+// f at every key below n: what bookkeeping a request carries meets, row by row (where each grant went, say).
+export const everyBelow = (n, f) => everyKey(k => k.lt(n).implies(f(k)));
 const when_ = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) }, c.ok === undefined ? undefined : valOf(c.ok ? then : otherwise));
 const isPartsWrite = (u) => typeof u === 'object' && u !== null && 'parts' in u;
 // The parts of a value written at a cell, by the names of the maps they go to.
@@ -995,7 +1034,7 @@ export class CarriedList {
             .state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, typeof d.from === 'number' ? d.from : (p) => d.from(p)])) })
             .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i), env)])) }));
         const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
-        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))), { search: false });
     }
     // Every carried map it is kept in: the items' parts, then each fold's.
     get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
@@ -1374,7 +1413,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         const r = r0.state({ x: 0, fx: ((p) => (zeroReads ? p.fx0 : zeroAt(args.map(a => p[a])))) })
             .step((env) => ({ x: env.x.plus(1), fx: def.next(env.x, env.fx, envAt(args.map(a => env[a]))) }));
         const laws = Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a])))));
-        verdict = proveRule(r, laws);
+        verdict = proveRule(r, laws, { search: false });
         failed('lemmas', verdict);
         proofs.lemmas = { machine: r.machine, laws };
     }
@@ -1411,13 +1450,17 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
             .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(at(env))) }));
         const laws = [...Object.entries(lemmas).map(([n, l]) => r.law(`${n} at y`, (env) => l(env.y, env.fy, envAt(at(env))))),
             ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env)))))];
-        const v = proveRule(r, laws);
+        const v = proveRule(r, laws, { search: false });
         failed('laws between two points', v);
         proofs.between = { machine: r.machine, laws };
         verdict = { proven: true, checked: verdict.checked && v.checked };
     }
-    return { ...base, verdict, facts: facts(true) };
+    const out = { ...base, verdict, facts: facts(true) };
+    recurDefs.set(out, { name, def: def, lemmas: lemmas, between: between });
+    return out;
 };
+const recurDefs = new WeakMap();
+export const recurOf = (d) => recurDefs.get(d);
 const distinctNames = (what, names) => { if (new Set(names).size !== names.length)
     throw new Error(`${what}: a name given twice`); };
 // A recurrence as JavaScript: a function of its arguments, the functions it reads inlined (each called on its arguments,
@@ -1527,6 +1570,21 @@ export class Rule {
     }
     with(more) { return new Rule({ ...this.spec, ...more }); }
     get name() { return this.spec.name; }
+    // For core/discover.ts: the functions and carried lists the rule reads, and the same rule with functions made again
+    // and lemmas added to its lists' folds (each proven here, as carriesList proves its own).
+    get parts() {
+        return { params: this.spec.params, fns: this.spec.fns ?? [], lists: this.spec.lists2 ?? [] };
+    }
+    withParts(fns, listLemmas = {}) {
+        const lists = (this.spec.lists2 ?? []).map(([n, k, fs, ls]) => [n, k, fs, { ...ls, ...(listLemmas[n] ?? {}) }]);
+        for (const [n, k, fs, ls] of lists)
+            if (listLemmas[n]) {
+                const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, undefined, this.spec.params).prove();
+                if (!(v2.proven && v2.checked))
+                    throw new Unproven(`${n}'s fold lemmas`, v2);
+            }
+        return this.with({ fns: (this.spec.fns ?? []).map(([n, d]) => [n, fns[n] ?? d]), lists2: lists });
+    }
     params(kinds) { return this.with({ params: [...this.spec.params, ...Object.entries(kinds)] }); }
     inputs(kinds) { return this.with({ inputs: [...this.spec.inputs, ...Object.entries(kinds)] }); }
     // Each variable starts at a natural or at a term over the params, or is declared by a kind and starts where `from`
@@ -1612,6 +1670,16 @@ export class Rule {
     facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
     // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
+    // Sequences each request carries (SeqRef): `.carriesSeq('Path')`, then `Path.at(i)`, `Path.len`, `A.prefixOf(B)`; the
+    // request gives each as an array of naturals.
+    carriesSeq(...names) {
+        return this.with({ carried: [...(this.spec.carried ?? []), ...names], inputs: [...this.spec.inputs, ...names.map(n => [`${n}_len`, nat])], seqs: [...(this.spec.seqs ?? []), ...names] });
+    }
+    // Tables of sequences each request carries (SeqTable): `.carriesSeqs('Paths')`, then `Paths.row(r)`, `Paths.rows`; the
+    // request gives each as an array of arrays of naturals.
+    carriesSeqs(...names) {
+        return this.with({ carried: [...(this.spec.carried ?? []), ...names.flatMap(n => [n, `${n}_base`, `${n}_len`])], inputs: [...this.spec.inputs, ...names.map(n => [`${n}_rows`, nat])], seqTables: [...(this.spec.seqTables ?? []), ...names] });
+    }
     // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
     //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
     // Each fold's start and step, and each lemma, may read the params declared before it.
@@ -1758,6 +1826,8 @@ export class Rule {
     // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state; the
     // functions' facts are assumed at the arguments the decision reads them at, and a carried list's equations (each
     // fold's start, its step and its lemmas) at the list's end, the key before it and every key the decision reads it at.
+    // A condition about every key (`everyKey`, `subsetOf`, ...) in `given` or `then` makes the decision a step law of
+    // this rule (its conditions as flags, the step left as it is): the flags' quantifiers are what the kernel closes.
     decide(name, given, then) {
         const env = this.env({ flags: false, state: false, queries: false });
         const g = given(env), hyps = [...this.kindAssumptions(), ...this.spec.pre.map(f => f(env).c), ...this.spec.assume.map(f => f(env).c), ...(Array.isArray(g) ? g : [g]).map(c => c.c)];
@@ -1766,7 +1836,14 @@ export class Rule {
         const listed = lists.flatMap(l => l.equationsAt(uniqueTerms([l.len, l.len.minus(1), ...keysRead([...hyps, t], l.maps)])).map(c => c.c));
         const goal = { name, hyps: [...listed, ...hyps, { op: 'not', x: t }] };
         const facts = this.spec.fns?.length || this.spec.facts?.length ? factsFor(this.machine, goal) : [];
-        return withSource({ name, rule: this, given: hyps, then: t, goal: { name, hyps: [...facts, ...goal.hyps] } }, { decision: { given: given, then: then, own: Array.isArray(g) ? g.length : 1 } });
+        const d = { name, rule: this, given: hyps, then: t, goal: { name, hyps: [...facts, ...goal.hyps] } };
+        if ([...(Array.isArray(g) ? g : [g]).map(c => c.c), t].some(quantifiedIn)) {
+            const conds = (e) => { const own = given(e); return { given$: all(...(Array.isArray(own) ? own : [own])), then$: then(e) }; };
+            const r = (this.spec.step ? this : this.step(() => ({}))).flags(conds);
+            const flag = (f) => (env) => env[f];
+            d.steps = { rule: r, law: r.stepLaw(name, flag('then$'), flag('given$')) };
+        }
+        return withSource(d, { decision: { given: given, then: then, own: Array.isArray(g) ? g.length : 1 } });
     }
     // A decision about two requests under the same params (noninterference, say: requests that differ only in a secret
     // are decided alike). `given` and `then` read both; the second request's inputs are named b.<input> in a witness.
@@ -1818,6 +1895,15 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            for (const n of this.spec.seqs ?? []) {
+                delete out[`${n}_len`];
+                out[n] = new SeqRef(new MapRef(n, 0), v(`${n}_len`));
+            }
+            for (const n of this.spec.seqTables ?? []) {
+                for (const part of [`${n}_base`, `${n}_len`, `${n}_rows`])
+                    delete out[part];
+                out[n] = new SeqTable(n, v(`${n}_rows`));
+            }
             const ps = Object.fromEntries(this.spec.params.map(([n]) => [n, out[n]]));
             for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
                 const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, ps, this.spec.params);
@@ -2159,16 +2245,35 @@ export class Rule {
     // --- running it -----------------------------------------------------------------------------------------------------
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
-    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural; a sequence an array of
+    // naturals, a table of them an array of such arrays.
     // A carried list is an array of its items' runtime values (its length and folds computed from them); `params`, what
     // folds that read the params are computed with.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     encodeInput(values, params) {
         const at = params && this.paramValues(this.encodeParams(params));
         const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, at).encode(values[n])]));
-        const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
+        // A sequence: its values at their positions (no 0 cell), its length; a table: the rows one after another in one map,
+        // each row's offset and length.
+        const seqMaps = {}, seqLens = {};
+        const cells = (xs, from = 0) => xs.flatMap((x, i) => (x ? [[from + i, x]] : []));
+        for (const n of this.spec.seqs ?? []) {
+            const xs = values[n] ?? [];
+            seqMaps[n] = new Map(cells(xs));
+            seqLens[`${n}_len`] = xs.length;
+        }
+        for (const n of this.spec.seqTables ?? []) {
+            const rows = values[n] ?? [], base = [];
+            rows.reduce((at, r) => (base.push(at), at + r.length), 0);
+            seqMaps[n] = new Map(rows.flatMap((r, i) => cells(r, base[i])));
+            seqMaps[`${n}_base`] = new Map(base.flatMap((b, i) => (b ? [[i, b]] : [])));
+            seqMaps[`${n}_len`] = new Map(rows.flatMap((r, i) => (r.length ? [[i, r.length]] : [])));
+            seqLens[`${n}_rows`] = rows.length;
+        }
+        const out = encode(this.spec.inputs, { ...values, ...seqLens, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
         for (const l of Object.values(lists))
             Object.assign(out, l.maps);
+        Object.assign(out, seqMaps);
         for (const n of this.spec.carried ?? []) {
             if (n in out)
                 continue;
@@ -2249,6 +2354,8 @@ const expandParts = (updates) => {
 };
 const encode = (kinds, values) => Object.assign({}, ...kinds.map(([n, k]) => k.encode(n, values[n])));
 export const rule = (name) => new Rule({ name, params: [], inputs: [], state: [], maps: [], flags: [], pre: [], assume: [], sums: [], queries: [] });
+const quantifiedE = (e) => e.op === 'if' ? quantifiedIn(e.c) || quantifiedE(e.then) || quantifiedE(e.else) : 'a' in e && typeof e.a === 'object' ? quantifiedE(e.a) || ('b' in e && typeof e.b === 'object' && quantifiedE(e.b)) : false;
+const quantifiedIn = (c) => c.op === 'all' || (c.op === 'not' ? quantifiedIn(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.some(quantifiedIn) : c.op === 'flag' ? false : quantifiedE(c.a) || quantifiedE(c.b));
 // The kind a result field is kept in.
 const kindOf = (t) => (t instanceof Cond ? bool : t instanceof Int ? int : t instanceof Decimal ? decimal(t.places) : t instanceof Choice ? oneOf(...t.values) : t instanceof Str ? str({ like: t.patterns })
     : t instanceof Variant ? t.kind : t instanceof Maybe ? maybe(kindOf(t.inner)) : isRecord(t) ? record(Object.fromEntries(Object.entries(t).map(([f, x]) => [f, kindOf(x)]))) : nat);
@@ -2402,14 +2509,16 @@ const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.na
 // interpreter took. A rule that reads functions is skipped: the kernel knows them only by their facts (a recurrence's
 // induction machine reads the function it proves things about), so a run computing them proves nothing about the goal.
 const refuteBudget = { trials: 60, depth: 6, bound: 3, ms: 150 };
-function refuteByRuns(r, laws, stepLaws = []) {
+// The search's own runs, before it looks for what the laws need: deeper and wider, from another seed.
+const deeperBudget = { trials: 600, depth: 24, bound: 8, ms: 1500, seed: 29 };
+function refuteByRuns(r, laws, stepLaws = [], budget = refuteBudget) {
     const m = r.machine;
     if (Object.keys(m.fns ?? {}).length || m.facts?.length)
         return undefined;
-    const run = interpret(m), rand = seeded(13), until = performance.now() + refuteBudget.ms, bound = refuteBudget.bound;
+    const run = interpret(m), rand = seeded(budget.seed ?? 13), until = performance.now() + budget.ms, bound = budget.bound;
     const shown = (input) => Object.fromEntries(Object.entries(input).map(([n, x]) => [n, typeof x === 'number' ? x : Object.fromEntries(x)]));
     try {
-        for (let trial = 0; trial < refuteBudget.trials && performance.now() < until; trial++) {
+        for (let trial = 0; trial < budget.trials && performance.now() < until; trial++) {
             const params = r.randomParams(rand, bound);
             if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
                 continue;
@@ -2421,7 +2530,7 @@ function refuteByRuns(r, laws, stepLaws = []) {
             for (const { w, on } of watching)
                 if (!('then' in w) && !on.start(st))
                     return broken(w, '@start', st);
-            for (let d = 0, tries = 0; d < refuteBudget.depth && tries < 40; tries++) {
+            for (let d = 0, tries = 0; d < budget.depth && tries < 40; tries++) {
                 const input = r.randomInput(rand, bound, params);
                 if (!allowed(m, run, params, st, input))
                     continue;
@@ -2441,7 +2550,7 @@ function refuteByRuns(r, laws, stepLaws = []) {
         // variable of a kind is drawn as its kind draws (33 yes/nos drawn from 0..7 almost never make a lawful state).
         const steps1 = stepLaws.filter(sl => (sl.steps ?? 1) === 1), given = withKinds(r, laws);
         const wide = Object.keys(m.state).length + m.inputs.length >= 32, lawsHere = wide ? given : [], kinded = wide ? r.kindsOfState() : [];
-        for (let trial = 0; !m.history && (steps1.length || lawsHere.length) && trial < refuteBudget.trials * 4 && performance.now() < until; trial++) {
+        for (let trial = 0; !m.history && (steps1.length || lawsHere.length) && trial < budget.trials * 4 && performance.now() < until; trial++) {
             const params = r.randomParams(rand, bound);
             if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
                 continue;
@@ -2469,25 +2578,56 @@ function refuteByRuns(r, laws, stepLaws = []) {
     return undefined;
 }
 const refutedVerdict = (out) => ({ proven: false, checked: false, goal: out.goal, stuck: 'sat', witness: out.witness, ...(out.run ? { run: out.run } : {}) });
-export function proveRule(r, laws) {
+export function proveRule(r, laws, opts = {}) {
     const refuted = refuteByRuns(r, laws);
     if (refuted)
         return refutedVerdict(refuted);
     const out = proveLaws(r.machine, withKinds(r, laws));
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    const v = { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    return searched(r, laws, [], v, opts);
 }
-export function proveSteps(r, laws, stepLaws) {
+export function proveSteps(r, laws, stepLaws, opts = {}) {
     const refuted = refuteByRuns(r, laws, stepLaws);
     if (refuted)
         return refutedVerdict(refuted);
     const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    const v = { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    return searched(r, laws, stepLaws, v, opts);
+}
+// The search, where the prover alone didn't prove the laws and nothing refuted them: the lemmas first where the rule has
+// recurrences or carried lists (the rule made again with them), then invariants over what it then is. The verdict is the
+// prover's on the laws with what was found; when nothing is found, the prover's own (with why).
+function searched(r, laws, stepLaws, v, opts) {
+    if ((v.proven && v.checked) || opts.search === false || v.run || v.stuck === 'sat' && !/@step|@\d+ steps/.test(v.goal ?? ''))
+        return v;
+    const deeper = refuteByRuns(r, laws, stepLaws, deeperBudget);
+    if (deeper?.run)
+        return refutedVerdict(deeper);
+    const until = performance.now() + (typeof opts.search === 'object' && opts.search.ms !== undefined ? opts.search.ms : 10_000);
+    let rule = r, lemmas;
+    const { fns, lists } = r.parts;
+    if (lists.length || fns.some(([, d]) => recurOf(d))) {
+        const d = discover(r, laws, stepLaws, v);
+        if (d.verdict.proven && d.verdict.checked)
+            return { ...d.verdict, found: { lemmas: d.found } };
+        if (Object.keys(d.found).length)
+            (rule = d.rule, lemmas = d.found);
+    }
+    const ms = until - performance.now();
+    if (ms < 500)
+        return v;
+    const inf = inferLaws(rule, laws, stepLaws, { ms, ...(rule === r ? { first: v } : {}) });
+    if (!(inf.proven && inf.checked))
+        return { ...v, why: [v.why, `the search found nothing that proves it in ${Math.round(inf.stats.ms)} ms`].filter(Boolean).join('; ') };
+    const { found, stats: _stats, ...verdict } = inf;
+    void _stats;
+    return { ...verdict, found: { laws: found, ...(lemmas ? { lemmas } : {}) } };
 }
 export function proveLeadsTo(r, laws, l) {
     const out = proveLiveness(r.machine, withKinds(r, laws), l);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
-export const proveDecision = (d) => goalsVerdict([d.goal]);
+export const proveDecision = (d) => (d.steps ? proveSteps(d.steps.rule, [], [d.steps.law], { search: false }) : goalsVerdict([d.goal]));
 const seeded = (seed) => { let x = seed; return k => { x = (x * 1103515245 + 12345) % 2 ** 31; return Math.floor(x / 2 ** 31 * k); }; };
 // A decision's callbacks against its condition, on random params and requests: `given` and `then` each run with every
 // value known, against what the interpreter evaluates of the decision built from them.

package/dist/core/infer.d.ts

@@ -0,0 +1,29 @@
+import { type Law, type Machine, type State } from './machine.js';
+import { type StepLaw, type Verdict, proveRule } from './dsl.js';
+type AnyRule = Parameters<typeof proveRule>[0];
+export type InferOptions = {
+    ms?: number;
+    runsMs?: number;
+    seen?: State[];
+    constants?: number[];
+    maxCandidates?: number;
+    first?: Verdict;
+    progress?: (phase: string, info: Record<string, number | string>) => void;
+};
+export type Found = {
+    law: Law;
+    text: string;
+    source?: string;
+};
+export type Inferred = Verdict & {
+    found: Found[];
+    stats: {
+        samples: number;
+        candidates: number;
+        alive: number;
+        proofs: number;
+        ms: number;
+    };
+};
+export declare function inferLaws(target: AnyRule | Machine, laws: Law[], stepLaws?: StepLaw[], opts?: InferOptions): Inferred;
+export {};