gdp-wired 0.15.0 → 0.16.0

package/README.md

@@ -69,6 +69,10 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   machine runs as, with each guard and action it names given again in gdp-wired's terms, and `conforms(chart, machine,
   createActor)` drives XState's own actor and the compiled rule with the same random events, comparing every state and
   context; what a chart can't run the same way is refused when built, with the reason (`examples/xstate.ts`).
+- **What nobody stated, looked for when the prover alone stops**: where `proveRule` or `proveSteps` doesn't prove the laws
+  and no run breaks them, it looks for lemmas about the rule's recurrences and lists (`discover`) and then invariants
+  (`inferLaws`), within 10 s (`{search: {ms}}`; `{search: false}`, the prover alone); the verdict's `found` holds what
+  proved them, as laws and lemmas with the source to paste.
 - **Invariants nobody wrote** (`gdp-wired/infer`): `inferLaws(rule, laws)` proves a law that holds but isn't inductive
   alone, with the laws it finds (bounds, sums and differences over the state, the same where a flag or a choice holds
   one value, and laws about every key of a map), each proven by the kernel with yours and handed back as the
@@ -246,6 +250,13 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   `Acct.set(k, value)`, `Acct.each(k => value)`) and `.items({Queue: Job})` (`push`, `pop`, `set`, `insertAt`,
   `removeAt`, `apply`, `has`, `within`, `increasing(by)`), one map per variable of the kind; `rule.decode` reads them back
   as objects and arrays.
+- **Sequences a request carries** (`.carriesSeq('Path')`, and tables of them, `.carriesSeqs('Paths')`): a sequence of
+  naturals as positions and a length, `Path.at(i)`, `Path.len`, a table's row `Paths.row(r)`; `A.prefixOf(B)`,
+  `startsWith`, `equals`, `extends(B, k)`, `has(x)`, each a condition about every position below a length, so laws about
+  prefixes of paths need no induction or lemma. The request gives an array of naturals (interned names), a table an
+  array of them. `everyBelow(n, k => ...)` checks bookkeeping a request carries row by row (where each grant went). A
+  condition about every row of a table can't compare the rows' sequences (that is two keys at once); compare a row at a
+  named row, a witness, instead (`examples/scopes.ts`: pi-fabric's path scopes, covering, attenuation and normalization).
 - **Lists a request carries** (`.carriesList('Lines', Line, folds, lemmas)`): the items one carried map per variable of
   the kind, the length `Lines.len`, each fold (`{total: {from: 0, step: (acc, line) => acc.plus(line.amount)}}`) a
   carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the

package/dist/core/chart.js

@@ -256,9 +256,9 @@ export class Chart {
                     missed.push({ name, law: r.law(`${name} is never reached`, (env) => env[reg.field].is(l).not()) });
             }
         const proven = (v) => v.proven && v.checked;
-        const allMissed = missed.length > 0 && proven(proveRule(r, [...this.chartLaws(), ...missed.map(x => x.law)]));
+        const allMissed = missed.length > 0 && proven(proveRule(r, [...this.chartLaws(), ...missed.map(x => x.law)], { search: false }));
         for (const x of missed)
-            reached[x.name] = allMissed || proven(proveRule(r, [...this.chartLaws(), x.law])) ? 'unreachable' : 'unknown';
+            reached[x.name] = allMissed || proven(proveRule(r, [...this.chartLaws(), x.law], { search: false })) ? 'unreachable' : 'unknown';
         // A way out is a transition to a state: an internal one stays where it is.
         const stuck = regions.flatMap(reg => reg.leaves.filter(l => !reg.finals.has(l) && !placed.some(t => t.to !== undefined && t.region === reg.name && t.sources.includes(l))).map(l => label(reg, l)));
         // Pairs as specific as each other, on one event, from a state they share: proven never both enabled, all at once,
@@ -270,9 +270,9 @@ export class Chart {
             pairs.push({ t, u, law: r.stepLaw(`transitions ${t.order} and ${u.order} on ${t.event} are never both enabled`, (env) => all(env[`on${i}`], env[`on${j}`]).not()) });
         }));
         const ambiguous = [];
-        if (pairs.length && !proven(proveSteps(r, this.chartLaws(), pairs.map(x => x.law))))
+        if (pairs.length && !proven(proveSteps(r, this.chartLaws(), pairs.map(x => x.law), { search: false })))
             for (const { t, u, law } of pairs) {
-                const v = proveSteps(r, this.chartLaws(), [law]);
+                const v = proveSteps(r, this.chartLaws(), [law], { search: false });
                 if (!proven(v))
                     ambiguous.push({ event: t.event, transitions: [t.order, u.order], verdict: v });
             }

package/dist/core/discover.d.ts

@@ -12,7 +12,7 @@ export type Discovery = {
     rule: AnyRule;
     found: Record<string, Found>;
 };
-export declare function discover(r: AnyRule, laws: Law[], stepLaws?: StepLaw[]): Discovery;
+export declare function discover(r: AnyRule, laws: Law[], stepLaws?: StepLaw[], first?: Verdict): Discovery;
 type TreeFold = {
     fold: Fold;
     lemmas?: Law[];

package/dist/core/discover.js

@@ -259,8 +259,8 @@ function houdiniList(r, part, cands, params) {
 // --- the search ----------------------------------------------------------------------------------------------------
 // The laws of r, and where they aren't proven as r states them, the lemmas found for its functions and lists: all that
 // is proven first, then each dropped in turn while the laws stay proven without it.
-export function discover(r, laws, stepLaws = []) {
-    const first = proveSteps(r, laws, stepLaws);
+// `first`: the laws' verdict on r alone, when the caller has it.
+export function discover(r, laws, stepLaws = [], first = proveSteps(r, laws, stepLaws, { search: false })) {
     if (first.proven && first.checked)
         return { verdict: first, rule: r, found: {} };
     const { params, fns, lists } = r.parts, ps = natParams(params);
@@ -284,7 +284,7 @@ export function discover(r, laws, stepLaws = []) {
             listKept[part[0]] = out.kept;
         }
     }
-    const verdict = proveSteps(rule, laws, stepLaws);
+    const verdict = proveSteps(rule, laws, stepLaws, { search: false });
     const found = () => ({
         ...Object.fromEntries(Object.entries(fnMade).map(([n, m]) => { const args = [...(recurOf(m.d).def.args ?? [])]; return [n, { ...(m.lemmas.length ? { lemmas: m.lemmas.map(c => recurSrc(c, args, false)) } : {}), ...(m.between.length ? { between: m.between.map(c => recurSrc(c, args, true)) } : {}) }]; })),
         ...Object.fromEntries(Object.entries(listKept).map(([n, cs]) => [n, { lemmas: cs.map(c => listSrc(c, Object.keys(lists.find(l => l[0] === n)[2]), ps, c.target)) }])),
@@ -297,7 +297,7 @@ export function discover(r, laws, stepLaws = []) {
     // A rule made again and the laws proven of it; or the lemma whose proof failed without the one dropped.
     const tryRule = (next) => {
         try {
-            const r2 = next(), v = proveSteps(r2, laws, stepLaws);
+            const r2 = next(), v = proveSteps(r2, laws, stepLaws, { search: false });
             return v.proven && v.checked ? { rule: r2, verdict: v } : undefined;
         }
         catch (e) {

package/dist/core/dsl.d.ts

@@ -299,6 +299,26 @@ export declare class ListRef {
     within(): Forall;
     increasing(): Forall;
 }
+export declare class SeqRef {
+    private readonly map;
+    readonly len: Term;
+    private readonly base?;
+    constructor(map: MapRef, len: Term, base?: Term | undefined);
+    at(i: TermLike): Term;
+    private agree;
+    prefixOf(o: SeqRef): Cond;
+    startsWith(o: SeqRef): Cond;
+    equals(o: SeqRef): Cond;
+    extends(o: SeqRef, by: TermLike): Cond;
+    has(x: TermLike): Cond;
+}
+export declare class SeqTable {
+    readonly name: string;
+    readonly rows: Term;
+    constructor(name: string, rows: Term);
+    row(r: TermLike): SeqRef;
+}
+export declare const everyBelow: (n: TermLike, f: (key: Term) => Cond) => Cond;
 export type PartsWrite = {
     readonly parts: Record<string, MapWrite>;
 };
@@ -473,6 +493,8 @@ type Spec = {
     nodes?: [string, Kind<unknown>, string[], Record<string, NodeFold<unknown, string>>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
+    seqs?: string[];
+    seqTables?: string[];
     lists2?: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
     fns?: [string, FnDef][];
     facts?: ((env: never) => Record<string, Cond | Forall>)[];
@@ -539,6 +561,12 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     carries<const N extends string>(...names: N[]): Rule<P, I & {
         [k in N]: MapRef;
     }, S, M, F, R, Su, Q>;
+    carriesSeq<const N extends string>(...names: N[]): Rule<P, I & {
+        [k in N]: SeqRef;
+    }, S, M, F, R, Su, Q>;
+    carriesSeqs<const N extends string>(...names: N[]): Rule<P, I & {
+        [k in N]: SeqTable;
+    }, S, M, F, R, Su, Q>;
     carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V, P>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term, p: P) => Cond>): Rule<P, I & {
         [k in N]: CarriedList<V, Fd>;
     }, S, M, F, R, Su, Q>;
@@ -604,7 +632,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
         [k in keyof P]: Raw;
     }): Record<string, number>;
     encodeInput(values: {
-        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
+        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends SeqRef ? readonly number[] : I[k] extends SeqTable ? readonly (readonly number[])[] : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
     }, params?: {
         [k in keyof P]: Raw;
     }): Request;
@@ -678,7 +706,7 @@ type Value<T> = {
     [k in keyof T]: ValueOf<T[k]>;
 };
 type RawInputs<T> = {
-    [k in keyof T]: T[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : T[k] extends CarriedList<infer V, infer _F> ? readonly ValueOf<V>[] : ValueOf<T[k]>;
+    [k in keyof T]: T[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : T[k] extends SeqRef ? readonly number[] : T[k] extends SeqTable ? readonly (readonly number[])[] : T[k] extends CarriedList<infer V, infer _F> ? readonly ValueOf<V>[] : ValueOf<T[k]>;
 };
 type Field = Term | Cond | Int | Decimal | Choice<string> | Str | Variant<any, any> | Maybe<any> | {
     [f: string]: Field | number;
@@ -770,13 +798,30 @@ export type Verdict = {
         params: Record<string, number>;
         trace: Record<string, unknown>[];
     };
+    found?: Found;
+};
+export type Found = {
+    laws?: {
+        law: Law;
+        text: string;
+        source?: string;
+    }[];
+    lemmas?: Record<string, {
+        lemmas?: string[];
+        between?: string[];
+    }>;
+};
+export type ProveOptions = {
+    search?: boolean | {
+        ms?: number;
+    };
 };
 export declare class Unproven extends Error {
     readonly verdict: Verdict;
     constructor(what: string, verdict: Verdict);
 }
-export declare function proveRule(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[]): Verdict;
-export declare function proveSteps(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], stepLaws: StepLaw[]): Verdict;
+export declare function proveRule(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], opts?: ProveOptions): Verdict;
+export declare function proveSteps(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], stepLaws: StepLaw[], opts?: ProveOptions): Verdict;
 export type { StepLaw };
 export type { Liveness };
 export declare function proveLeadsTo(r: Rule<Obj, Obj, Obj, Obj, Obj, Obj, Obj, Obj>, laws: Law[], l: Liveness): Verdict;

package/dist/core/dsl.js

@@ -19,6 +19,8 @@ import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersO
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
 import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
+import { discover } from "./discover.js";
+import { inferLaws } from "./infer.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
     if (!Number.isSafeInteger(v) || v < 0)
@@ -860,6 +862,43 @@ export class ListRef {
     within() { return forall(k => this.len.atMost(k).implies(this.at(k).eq(0))); }
     increasing() { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(this.at(i).lt(this.at(j)))); }
 }
+// A sequence of naturals as positions and a length (a path's segments, as interned names): `at(i)` its value at i,
+// `len` its length. Comparing two is a condition about every position below a length (the array property fragment,
+// decidable), so a law about prefixes needs no induction. One a request carries (`carriesSeq`), or a row of a table of
+// them (`carriesSeqs`), its positions read from its row's offset in the table's one map.
+export class SeqRef {
+    map;
+    len;
+    base;
+    constructor(map, len, base) {
+        this.map = map;
+        this.len = len;
+        this.base = base;
+    }
+    at(i) { return this.map.at(!this.base ? i : typeof i === 'number' ? this.base.plus(i) : i.plus(this.base)); }
+    // The same values at every position below `upTo` (both have them).
+    agree(o, upTo) { return everyKey(k => k.lt(upTo).implies(this.at(k).eq(o.at(k)))); }
+    // This one is where o starts; o is where this one starts; the same; o followed by `by` more; x at some position.
+    prefixOf(o) { return this.len.atMost(o.len).and(this.agree(o, this.len)); }
+    startsWith(o) { return o.prefixOf(this); }
+    equals(o) { return this.len.eq(o.len).and(this.agree(o, this.len)); }
+    extends(o, by) { return o.prefixOf(this).and(this.len.eq(o.len.plus(by))); }
+    has(x) { return everyKey(k => k.lt(this.len).implies(this.at(k).ne(x))).not(); }
+}
+// A table of sequences a request carries (each grant's path, say): `row(r)` is row r's sequence, `rows` how many. Rows
+// are read by their number as a map's key, so a condition about every row reads a row only there (`everyBelow(T.rows,
+// r => ...)`).
+export class SeqTable {
+    name;
+    rows;
+    constructor(name, rows) {
+        this.name = name;
+        this.rows = rows;
+    }
+    row(r) { return new SeqRef(new MapRef(this.name, 0), new MapRef(`${this.name}_len`, 0).at(r), new MapRef(`${this.name}_base`, 0).at(r)); }
+}
+// f at every key below n: what bookkeeping a request carries meets, row by row (where each grant went, say).
+export const everyBelow = (n, f) => everyKey(k => k.lt(n).implies(f(k)));
 const when_ = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) }, c.ok === undefined ? undefined : valOf(c.ok ? then : otherwise));
 const isPartsWrite = (u) => typeof u === 'object' && u !== null && 'parts' in u;
 // The parts of a value written at a cell, by the names of the maps they go to.
@@ -995,7 +1034,7 @@ export class CarriedList {
             .state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, typeof d.from === 'number' ? d.from : (p) => d.from(p)])) })
             .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i), env)])) }));
         const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
-        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))), { search: false });
     }
     // Every carried map it is kept in: the items' parts, then each fold's.
     get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
@@ -1374,7 +1413,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         const r = r0.state({ x: 0, fx: ((p) => (zeroReads ? p.fx0 : zeroAt(args.map(a => p[a])))) })
             .step((env) => ({ x: env.x.plus(1), fx: def.next(env.x, env.fx, envAt(args.map(a => env[a]))) }));
         const laws = Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a])))));
-        verdict = proveRule(r, laws);
+        verdict = proveRule(r, laws, { search: false });
         failed('lemmas', verdict);
         proofs.lemmas = { machine: r.machine, laws };
     }
@@ -1411,7 +1450,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
             .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(at(env))) }));
         const laws = [...Object.entries(lemmas).map(([n, l]) => r.law(`${n} at y`, (env) => l(env.y, env.fy, envAt(at(env))))),
             ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env)))))];
-        const v = proveRule(r, laws);
+        const v = proveRule(r, laws, { search: false });
         failed('laws between two points', v);
         proofs.between = { machine: r.machine, laws };
         verdict = { proven: true, checked: verdict.checked && v.checked };
@@ -1631,6 +1670,16 @@ export class Rule {
     facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
     // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
+    // Sequences each request carries (SeqRef): `.carriesSeq('Path')`, then `Path.at(i)`, `Path.len`, `A.prefixOf(B)`; the
+    // request gives each as an array of naturals.
+    carriesSeq(...names) {
+        return this.with({ carried: [...(this.spec.carried ?? []), ...names], inputs: [...this.spec.inputs, ...names.map(n => [`${n}_len`, nat])], seqs: [...(this.spec.seqs ?? []), ...names] });
+    }
+    // Tables of sequences each request carries (SeqTable): `.carriesSeqs('Paths')`, then `Paths.row(r)`, `Paths.rows`; the
+    // request gives each as an array of arrays of naturals.
+    carriesSeqs(...names) {
+        return this.with({ carried: [...(this.spec.carried ?? []), ...names.flatMap(n => [n, `${n}_base`, `${n}_len`])], inputs: [...this.spec.inputs, ...names.map(n => [`${n}_rows`, nat])], seqTables: [...(this.spec.seqTables ?? []), ...names] });
+    }
     // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
     //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
     // Each fold's start and step, and each lemma, may read the params declared before it.
@@ -1846,6 +1895,15 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            for (const n of this.spec.seqs ?? []) {
+                delete out[`${n}_len`];
+                out[n] = new SeqRef(new MapRef(n, 0), v(`${n}_len`));
+            }
+            for (const n of this.spec.seqTables ?? []) {
+                for (const part of [`${n}_base`, `${n}_len`, `${n}_rows`])
+                    delete out[part];
+                out[n] = new SeqTable(n, v(`${n}_rows`));
+            }
             const ps = Object.fromEntries(this.spec.params.map(([n]) => [n, out[n]]));
             for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
                 const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, ps, this.spec.params);
@@ -2187,16 +2245,35 @@ export class Rule {
     // --- running it -----------------------------------------------------------------------------------------------------
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
-    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural; a sequence an array of
+    // naturals, a table of them an array of such arrays.
     // A carried list is an array of its items' runtime values (its length and folds computed from them); `params`, what
     // folds that read the params are computed with.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     encodeInput(values, params) {
         const at = params && this.paramValues(this.encodeParams(params));
         const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, at).encode(values[n])]));
-        const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
+        // A sequence: its values at their positions (no 0 cell), its length; a table: the rows one after another in one map,
+        // each row's offset and length.
+        const seqMaps = {}, seqLens = {};
+        const cells = (xs, from = 0) => xs.flatMap((x, i) => (x ? [[from + i, x]] : []));
+        for (const n of this.spec.seqs ?? []) {
+            const xs = values[n] ?? [];
+            seqMaps[n] = new Map(cells(xs));
+            seqLens[`${n}_len`] = xs.length;
+        }
+        for (const n of this.spec.seqTables ?? []) {
+            const rows = values[n] ?? [], base = [];
+            rows.reduce((at, r) => (base.push(at), at + r.length), 0);
+            seqMaps[n] = new Map(rows.flatMap((r, i) => cells(r, base[i])));
+            seqMaps[`${n}_base`] = new Map(base.flatMap((b, i) => (b ? [[i, b]] : [])));
+            seqMaps[`${n}_len`] = new Map(rows.flatMap((r, i) => (r.length ? [[i, r.length]] : [])));
+            seqLens[`${n}_rows`] = rows.length;
+        }
+        const out = encode(this.spec.inputs, { ...values, ...seqLens, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
         for (const l of Object.values(lists))
             Object.assign(out, l.maps);
+        Object.assign(out, seqMaps);
         for (const n of this.spec.carried ?? []) {
             if (n in out)
                 continue;
@@ -2432,14 +2509,16 @@ const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.na
 // interpreter took. A rule that reads functions is skipped: the kernel knows them only by their facts (a recurrence's
 // induction machine reads the function it proves things about), so a run computing them proves nothing about the goal.
 const refuteBudget = { trials: 60, depth: 6, bound: 3, ms: 150 };
-function refuteByRuns(r, laws, stepLaws = []) {
+// The search's own runs, before it looks for what the laws need: deeper and wider, from another seed.
+const deeperBudget = { trials: 600, depth: 24, bound: 8, ms: 1500, seed: 29 };
+function refuteByRuns(r, laws, stepLaws = [], budget = refuteBudget) {
     const m = r.machine;
     if (Object.keys(m.fns ?? {}).length || m.facts?.length)
         return undefined;
-    const run = interpret(m), rand = seeded(13), until = performance.now() + refuteBudget.ms, bound = refuteBudget.bound;
+    const run = interpret(m), rand = seeded(budget.seed ?? 13), until = performance.now() + budget.ms, bound = budget.bound;
     const shown = (input) => Object.fromEntries(Object.entries(input).map(([n, x]) => [n, typeof x === 'number' ? x : Object.fromEntries(x)]));
     try {
-        for (let trial = 0; trial < refuteBudget.trials && performance.now() < until; trial++) {
+        for (let trial = 0; trial < budget.trials && performance.now() < until; trial++) {
             const params = r.randomParams(rand, bound);
             if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
                 continue;
@@ -2451,7 +2530,7 @@ function refuteByRuns(r, laws, stepLaws = []) {
             for (const { w, on } of watching)
                 if (!('then' in w) && !on.start(st))
                     return broken(w, '@start', st);
-            for (let d = 0, tries = 0; d < refuteBudget.depth && tries < 40; tries++) {
+            for (let d = 0, tries = 0; d < budget.depth && tries < 40; tries++) {
                 const input = r.randomInput(rand, bound, params);
                 if (!allowed(m, run, params, st, input))
                     continue;
@@ -2471,7 +2550,7 @@ function refuteByRuns(r, laws, stepLaws = []) {
         // variable of a kind is drawn as its kind draws (33 yes/nos drawn from 0..7 almost never make a lawful state).
         const steps1 = stepLaws.filter(sl => (sl.steps ?? 1) === 1), given = withKinds(r, laws);
         const wide = Object.keys(m.state).length + m.inputs.length >= 32, lawsHere = wide ? given : [], kinded = wide ? r.kindsOfState() : [];
-        for (let trial = 0; !m.history && (steps1.length || lawsHere.length) && trial < refuteBudget.trials * 4 && performance.now() < until; trial++) {
+        for (let trial = 0; !m.history && (steps1.length || lawsHere.length) && trial < budget.trials * 4 && performance.now() < until; trial++) {
             const params = r.randomParams(rand, bound);
             if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
                 continue;
@@ -2499,25 +2578,56 @@ function refuteByRuns(r, laws, stepLaws = []) {
     return undefined;
 }
 const refutedVerdict = (out) => ({ proven: false, checked: false, goal: out.goal, stuck: 'sat', witness: out.witness, ...(out.run ? { run: out.run } : {}) });
-export function proveRule(r, laws) {
+export function proveRule(r, laws, opts = {}) {
     const refuted = refuteByRuns(r, laws);
     if (refuted)
         return refutedVerdict(refuted);
     const out = proveLaws(r.machine, withKinds(r, laws));
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    const v = { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    return searched(r, laws, [], v, opts);
 }
-export function proveSteps(r, laws, stepLaws) {
+export function proveSteps(r, laws, stepLaws, opts = {}) {
     const refuted = refuteByRuns(r, laws, stepLaws);
     if (refuted)
         return refutedVerdict(refuted);
     const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    const v = { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    return searched(r, laws, stepLaws, v, opts);
+}
+// The search, where the prover alone didn't prove the laws and nothing refuted them: the lemmas first where the rule has
+// recurrences or carried lists (the rule made again with them), then invariants over what it then is. The verdict is the
+// prover's on the laws with what was found; when nothing is found, the prover's own (with why).
+function searched(r, laws, stepLaws, v, opts) {
+    if ((v.proven && v.checked) || opts.search === false || v.run || v.stuck === 'sat' && !/@step|@\d+ steps/.test(v.goal ?? ''))
+        return v;
+    const deeper = refuteByRuns(r, laws, stepLaws, deeperBudget);
+    if (deeper?.run)
+        return refutedVerdict(deeper);
+    const until = performance.now() + (typeof opts.search === 'object' && opts.search.ms !== undefined ? opts.search.ms : 10_000);
+    let rule = r, lemmas;
+    const { fns, lists } = r.parts;
+    if (lists.length || fns.some(([, d]) => recurOf(d))) {
+        const d = discover(r, laws, stepLaws, v);
+        if (d.verdict.proven && d.verdict.checked)
+            return { ...d.verdict, found: { lemmas: d.found } };
+        if (Object.keys(d.found).length)
+            (rule = d.rule, lemmas = d.found);
+    }
+    const ms = until - performance.now();
+    if (ms < 500)
+        return v;
+    const inf = inferLaws(rule, laws, stepLaws, { ms, ...(rule === r ? { first: v } : {}) });
+    if (!(inf.proven && inf.checked))
+        return { ...v, why: [v.why, `the search found nothing that proves it in ${Math.round(inf.stats.ms)} ms`].filter(Boolean).join('; ') };
+    const { found, stats: _stats, ...verdict } = inf;
+    void _stats;
+    return { ...verdict, found: { laws: found, ...(lemmas ? { lemmas } : {}) } };
 }
 export function proveLeadsTo(r, laws, l) {
     const out = proveLiveness(r.machine, withKinds(r, laws), l);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
-export const proveDecision = (d) => (d.steps ? proveSteps(d.steps.rule, [], [d.steps.law]) : goalsVerdict([d.goal]));
+export const proveDecision = (d) => (d.steps ? proveSteps(d.steps.rule, [], [d.steps.law], { search: false }) : goalsVerdict([d.goal]));
 const seeded = (seed) => { let x = seed; return k => { x = (x * 1103515245 + 12345) % 2 ** 31; return Math.floor(x / 2 ** 31 * k); }; };
 // A decision's callbacks against its condition, on random params and requests: `given` and `then` each run with every
 // value known, against what the interpreter evaluates of the decision built from them.

package/dist/core/infer.js

@@ -112,7 +112,7 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
     const prove = (ls) => {
         proofs++;
         if (rule)
-            return stepLaws.length ? proveSteps(rule, ls, stepLaws) : proveRule(rule, ls);
+            return stepLaws.length ? proveSteps(rule, ls, stepLaws, { search: false }) : proveRule(rule, ls, { search: false });
         const out = stepLaws.length ? proveStepLaws(m, ls, stepLaws) : proveLaws(m, ls);
         return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
     };
@@ -245,16 +245,18 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
     };
     const choose = (k, of) => { let r = 1; for (let i = 0; i < k; i++)
         r = r * (of - i) / (i + 1); return r; };
-    const plain = atoms.flatMap((a, i) => (a.cell ? [] : [i])), P = plain.length;
+    // A choice's index orders its values arbitrarily: it is a guard, or alone (a bound on it reads as the values it
+    // allows), never a term among others.
+    const plain = atoms.flatMap((a, i) => (a.cell ? [] : [i])), terms = plain.filter(i => !modeOf(i)?.choice), P = terms.length;
     const scalarOk = (acc) => acc.some(([i]) => !atoms[i].param);
     pick(1, [1], plain, scalarOk, false);
-    pick(2, choose(2, P) * 4 * mags.length ** 2 <= maxCandidates / 4 ? mags : [1], plain, scalarOk, false);
+    pick(2, choose(2, P) * 4 * mags.length ** 2 <= maxCandidates / 4 ? mags : [1], terms, scalarOk, false);
     if (choose(3, P) * 8 * mags.length ** 3 <= maxCandidates / 2)
-        pick(3, mags, plain, scalarOk, false);
+        pick(3, mags, terms, scalarOk, false);
     else if (choose(3, P) * 8 <= maxCandidates / 2)
-        pick(3, [1], plain, scalarOk, false);
+        pick(3, [1], terms, scalarOk, false);
     if (cellAtoms.length) {
-        const all = atoms.map((_, i) => i), cellOk = (acc) => acc.some(([i]) => atoms[i].cell) && acc.filter(([i]) => !atoms[i].cell).length <= 1;
+        const all = atoms.flatMap((_, i) => (modeOf(i)?.choice ? [] : [i])), cellOk = (acc) => acc.some(([i]) => atoms[i].cell) && acc.filter(([i]) => !atoms[i].cell).length <= 1;
         pick(1, [1], cellAtoms, () => true, true);
         pick(2, [1], all, cellOk, true);
         if (choose(3, A) * 8 <= maxCandidates / 4)
@@ -329,7 +331,8 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
             return `${nameOf(f.unreachable.atom)} is never ${shownValue(f.unreachable.atom, f.unreachable.value)}`;
         const { l, r } = sides(f), within = allowedValues(f);
         const body = within ? `${nameOf(f.coef[0][0])} is ${within.map(v => shownValue(f.coef[0][0], v)).join(' or ')}` : `${l} <= ${r}`;
-        const guarded = !f.guard ? body : 'keyNot' in f.guard ? `k = ${nameOf(f.guard.keyNot)} or ${body}` : `${nameOf(f.guard.atom)} is ${shownValue(f.guard.atom, f.guard.value)} → ${body}`;
+        const under = f.when ? (({ l: wl, r: wr }) => `${wl} <= ${wr} → `)(sides({ coef: f.when.coef, d: f.when.d, cells: false, size: 0 })) : '';
+        const guarded = !f.guard ? under + body : 'keyNot' in f.guard ? `k = ${nameOf(f.guard.keyNot)} or ${body}` : `${nameOf(f.guard.atom)} is ${shownValue(f.guard.atom, f.guard.value)} → ${under}${body}`;
         return f.cells ? `every k: ${guarded}` : guarded;
     };
     const sum = (es) => es.reduce((p, q) => plus(p, q), n(0));
@@ -347,12 +350,13 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
         if (f.unreachable)
             return notAt(f.unreachable.atom, f.unreachable.value);
         const lhs = sum([...partsOf(f, 1), ...(f.d < 0 ? [n(-f.d)] : [])]), rhs = sum([...partsOf(f, -1), ...(f.d > 0 ? [n(f.d)] : [])]);
-        const body = atMost(lhs, rhs);
+        // Under a condition Σ ≤ d: its negation, −Σ ≤ −d − 1, or the body.
+        const body = f.when ? any(condOf({ coef: f.when.coef.map(([i, c]) => [i, -c]), d: -f.when.d - 1, cells: false, size: 0 }), atMost(lhs, rhs)) : atMost(lhs, rhs);
         return !f.guard ? body : 'keyNot' in f.guard ? any(same(x(KEY), x(atoms[f.guard.keyNot].parts[0][0])), body) : any(notAt(f.guard.atom, f.guard.value), body);
     };
     // The builder call, for a rule whose atoms are its own variables (naturals, or integers alone).
     const sourceOf = (f, text) => {
-        if (!rule)
+        if (!rule || f.when)
             return undefined;
         const used = [...new Set([...f.coef.map(([i]) => i), ...(f.guard ? ['keyNot' in f.guard ? f.guard.keyNot : f.guard.atom] : []), ...(f.unreachable ? [f.unreachable.atom] : [])])];
         const ints = f.coef.filter(([i]) => atoms[i].int).length;
@@ -388,6 +392,13 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
             else if (valueOf(atoms[f.guard.atom], env) !== f.guard.value)
                 return true;
         }
+        if (f.when) {
+            let w = 0;
+            for (const [i, c] of f.when.coef)
+                w += c * valueOf(atoms[i], env);
+            if (w > f.when.d)
+                return true;
+        }
         let s = 0;
         for (const [i, c] of f.coef)
             s += c * valueOf(atoms[i], env);
@@ -489,6 +500,97 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
         }
         return pickF;
     };
+    // A counterexample to induction no candidate rules out: forms false at it that every sample meets under a condition
+    // it meets too (one value, or a sum or difference of two, at most a threshold: 0, ±1, or its own value there), the
+    // choice (loc, say) at its value there as the guard. A condition no sample meets gives its negation instead. Only the
+    // eight values most unusual at it are read (furthest past the samples in its guard, then the rarest there).
+    const choiceMode = modes.find(mo => mo.choice && !atoms[mo.atom].cell);
+    const condAtoms = plain.filter(i => !atoms[i].param && i !== choiceMode?.atom);
+    const fromCti = (p) => {
+        const stop = Math.min(until, performance.now() + Math.max(300, (until - performance.now()) / 8));
+        const sc = p.scalar, pv = (coef) => { let v = 0; for (const [i, c] of coef)
+            v += c * valueOf(atoms[i], sc); return v; };
+        const gv = choiceMode ? valueOf(atoms[choiceMode.atom], sc) : undefined;
+        const inGuard = [];
+        for (let j = 0; j < NS; j++)
+            if (gv === undefined || valsS[choiceMode.atom][j] === gv)
+                inGuard.push(j);
+        const unusual = (i) => {
+            const v = valueOf(atoms[i], sc);
+            let lo = Infinity, hi = -Infinity, same = 0;
+            for (const j of inGuard) {
+                const w = valsS[i][j];
+                if (w < lo)
+                    lo = w;
+                if (w > hi)
+                    hi = w;
+                if (w === v)
+                    same++;
+            }
+            return [Math.max(0, lo - v, v - hi), -same];
+        };
+        const focus = condAtoms.map(i => ({ i, u: unusual(i) })).sort((a, b) => b.u[0] - a.u[0] || b.u[1] - a.u[1]).slice(0, 8).map(x => x.i);
+        // Over the focus: one or two values with the magnitudes, three with ±1.
+        const bodies = [];
+        const signed = (ks) => ks.flatMap(k => [k, -k]);
+        for (const [a, i] of focus.entries()) {
+            bodies.push({ coef: [[i, 1]] }, { coef: [[i, -1]] });
+            for (const [b2, k] of focus.slice(a + 1).entries()) {
+                for (const c1 of signed(mags))
+                    for (const c2 of signed(mags))
+                        if (gcd(c1, c2) === 1)
+                            bodies.push({ coef: [[i, c1], [k, c2]] });
+                for (const q of focus.slice(a + b2 + 2))
+                    for (const c1 of [1, -1])
+                        for (const c2 of [1, -1])
+                            for (const c3 of [1, -1])
+                                bodies.push({ coef: [[i, c1], [k, c2], [q, c3]] });
+            }
+        }
+        const conds = [];
+        for (const [a, i] of focus.entries()) {
+            conds.push([[i, 1]], [[i, -1]]);
+            for (const k of focus.slice(a + 1))
+                conds.push([[i, 1], [k, -1]], [[i, -1], [k, 1]], [[i, 1], [k, 1]]);
+        }
+        const out = [], guard = choiceMode ? { atom: choiceMode.atom, value: gv } : undefined;
+        for (const coef of conds) {
+            const here = pv(coef);
+            for (const d of [...new Set([here, 0, 1, -1])].filter(d => here <= d)) {
+                if (performance.now() > stop)
+                    break;
+                const rows = [];
+                for (const j of inGuard)
+                    if (at(coef, valsS, j) <= d)
+                        rows.push(j);
+                const when = { coef, d }, base = sizeOf(coef) + 80;
+                if (!rows.length) {
+                    out.push({ coef: coef.map(([i, c]) => [i, -c]), d: -d - 1, cells: false, ...(guard ? { guard } : {}), size: base });
+                    continue;
+                }
+                const stride = Math.max(1, Math.ceil(rows.length / 600));
+                for (const [q, sh] of bodies.entries()) {
+                    if (q % 256 === 0 && performance.now() > stop)
+                        break;
+                    const v = pv(sh.coef);
+                    let most = -Infinity, ok = true;
+                    for (let t = 0; t < rows.length; t += stride) {
+                        const w = at(sh.coef, valsS, rows[t]);
+                        if (w >= v) {
+                            ok = false;
+                            break;
+                        }
+                        if (w > most)
+                            most = w;
+                    }
+                    if (ok && Number.isFinite(most))
+                        out.push({ coef: sh.coef, d: most, cells: false, ...(guard ? { guard } : {}), when, size: base + sizeOf(sh.coef) });
+                }
+            }
+        }
+        // A stride may skip a sample that breaks a form: each is checked again at every sample in its guard.
+        return out.sort((x, y) => x.size - y.size).slice(0, 2000).filter(f => inGuard.every(j => holdsRow(f, rowsS[j]))).slice(0, 400);
+    };
     // The search proves one law at a time (proveLaw), each with every law assumed, and keeps what it proved while laws
     // are only added (more laws assumed keep a proof a proof); dropping one forgets it all. Once every law is proven so,
     // the set is proven as a whole, by the rule's own prover: that verdict is the answer.
@@ -545,7 +647,13 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
         const p = /@step|@\d+ steps/.test(last.goal) && last.witness ? witnessPoint(last.witness) : undefined;
         if (p)
             ctis.push(p);
-        const next = p ? best(p) : undefined;
+        let next = p ? best(p) : undefined;
+        if (!next && p) {
+            const t = performance.now(), made = fromCti(p);
+            pool.push(...made);
+            next = best(p);
+            opts.progress?.('cti', { forms: made.length, ms: Math.round(performance.now() - t) });
+        }
         if (next) {
             chosen.push(next);
             continue;

package/dist/kernel/prove.js

@@ -283,6 +283,27 @@ function growPlain(goal, path, budget) {
                     return { tree: leafOf(third.steps, weighted, squares), nodes: budget.nodes };
             }
         }
+        // A multiplier: every row times a factor the path has at least 1 (the row 1 − x <= 0), with the squares (x·a − b)
+        // and (x·b − a) of each product a·b the rows read: a certificate that multiplies the goal by x first ((Σv)² <= n·Σv²
+        // over running samples is n times the goal, closed by (n·v − s)²).
+        const ones = rows.flatMap((r, i) => { const ks = Object.keys(r.lin); return ks.length === 2 && r.lin['1'] === 1 && ks.some(key => key !== '1' && r.lin[key] === -1 && factorSet.has(key)) ? [i] : []; });
+        for (const xi of ones.slice(0, 3)) {
+            const x = Object.keys(rows[xi].lin).find(key => key !== '1'), name = (fs) => [...fs].sort().join('*');
+            const forms = new Map();
+            for (const m of new Set(rows.flatMap(r => Object.keys(r.lin).filter(isMonomial)))) {
+                const [a, b, ...more] = factorsOf(m);
+                if (!a || !b || more.length)
+                    continue;
+                for (const [u, w] of [[a, b], [b, a]]) {
+                    const t = { [name([x, u])]: 1, [w]: -1 };
+                    forms.set(canon(t), t);
+                }
+            }
+            const times = relevant.map(i => [i, xi]), sq = [...forms.values()].slice(0, 32);
+            const multiplied = solve(withProducts(rows, times, sq));
+            if (multiplied.kind === 'refuted')
+                return { tree: leafOf(multiplied.steps, times, sq), nodes: budget.nodes };
+        }
         const factors = [...new Set(rows.flatMap(r => Object.keys(r.lin).filter(isMonomial).flatMap(factorsOf)))];
         const fresh = (lin) => !path.has(canon(lin)) && !path.has(canonFlip(lin));
         // Split a factor at zero, else two factors against each other (so (x - y)² >= 0 becomes a product of rows).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "An automatic prover for stateful rules (budgets, caps, windows, workflows, policies): laws proven with no proof to write, checked again in Lean, counterexamples found on the GPU, the rule shipped as code",
   "keywords": [
     "verification",
@@ -101,7 +101,7 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "smoke": "sh scripts/smoke.sh",
-    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts discover.test.ts infer.test.ts invoices.test.ts folds.test.ts trees.test.ts pairs.test.ts chart.test.ts xstate.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/guide.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/discover.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/trees.ts && bun examples/pairs.ts && bun examples/groups.ts && bun examples/charts.ts && bun examples/xstate.ts && bun examples/infer.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
+    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts discover.test.ts infer.test.ts seqs.test.ts search.test.ts invoices.test.ts folds.test.ts trees.test.ts pairs.test.ts chart.test.ts xstate.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/guide.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/discover.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/trees.ts && bun examples/pairs.ts && bun examples/groups.ts && bun examples/charts.ts && bun examples/xstate.ts && bun examples/infer.ts && bun examples/scopes.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
   },
   "devDependencies": {
     "@gdp-ts/core": "0.1.0",