gdp-wired 0.15.0 → 0.17.0

package/dist/core/dsl.js

@@ -18,7 +18,10 @@
 import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf, pairedArgs } from "./machine.js";
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
 import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
-import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
+import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws, withDeadline } from "../kernel/prove.js";
+import { crossCyclic, cyclicOn, foldNodes, proveCyclic, quietly, recurNodes } from "./cyclic.js";
+import { discover } from "./discover.js";
+import { inferLaws } from "./infer.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
     if (!Number.isSafeInteger(v) || v < 0)
@@ -860,6 +863,43 @@ export class ListRef {
     within() { return forall(k => this.len.atMost(k).implies(this.at(k).eq(0))); }
     increasing() { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(this.at(i).lt(this.at(j)))); }
 }
+// A sequence of naturals as positions and a length (a path's segments, as interned names): `at(i)` its value at i,
+// `len` its length. Comparing two is a condition about every position below a length (the array property fragment,
+// decidable), so a law about prefixes needs no induction. One a request carries (`carriesSeq`), or a row of a table of
+// them (`carriesSeqs`), its positions read from its row's offset in the table's one map.
+export class SeqRef {
+    map;
+    len;
+    base;
+    constructor(map, len, base) {
+        this.map = map;
+        this.len = len;
+        this.base = base;
+    }
+    at(i) { return this.map.at(!this.base ? i : typeof i === 'number' ? this.base.plus(i) : i.plus(this.base)); }
+    // The same values at every position below `upTo` (both have them).
+    agree(o, upTo) { return everyKey(k => k.lt(upTo).implies(this.at(k).eq(o.at(k)))); }
+    // This one is where o starts; o is where this one starts; the same; o followed by `by` more; x at some position.
+    prefixOf(o) { return this.len.atMost(o.len).and(this.agree(o, this.len)); }
+    startsWith(o) { return o.prefixOf(this); }
+    equals(o) { return this.len.eq(o.len).and(this.agree(o, this.len)); }
+    extends(o, by) { return o.prefixOf(this).and(this.len.eq(o.len.plus(by))); }
+    has(x) { return everyKey(k => k.lt(this.len).implies(this.at(k).ne(x))).not(); }
+}
+// A table of sequences a request carries (each grant's path, say): `row(r)` is row r's sequence, `rows` how many. Rows
+// are read by their number as a map's key, so a condition about every row reads a row only there (`everyBelow(T.rows,
+// r => ...)`).
+export class SeqTable {
+    name;
+    rows;
+    constructor(name, rows) {
+        this.name = name;
+        this.rows = rows;
+    }
+    row(r) { return new SeqRef(new MapRef(this.name, 0), new MapRef(`${this.name}_len`, 0).at(r), new MapRef(`${this.name}_base`, 0).at(r)); }
+}
+// f at every key below n: what bookkeeping a request carries meets, row by row (where each grant went, say).
+export const everyBelow = (n, f) => everyKey(k => k.lt(n).implies(f(k)));
 const when_ = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) }, c.ok === undefined ? undefined : valOf(c.ok ? then : otherwise));
 const isPartsWrite = (u) => typeof u === 'object' && u !== null && 'parts' in u;
 // The parts of a value written at a cell, by the names of the maps they go to.
@@ -995,7 +1035,7 @@ export class CarriedList {
             .state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, typeof d.from === 'number' ? d.from : (p) => d.from(p)])) })
             .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i), env)])) }));
         const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
-        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))), { search: false });
     }
     // Every carried map it is kept in: the items' parts, then each fold's.
     get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
@@ -1360,6 +1400,10 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
     const stated = Object.entries(lemmas).map(([n, f]) => { const holds = f(named('x'), named('fx'), envAt(own)).c; only(`lemma "${n}"`, holds, ['x', 'fx', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
     const pairs = Object.entries(between).map(([n, f]) => { const holds = f(named('x'), named('fx'), named('y'), named('fy'), envAt(own)).c; only(`law between "${n}"`, holds, ['x', 'fx', 'y', 'fy', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
     const argKinds = Object.fromEntries(args.map(a => [a, nat]));
+    // The recurrence as a cyclic proof's instance (core/cyclic.ts, GDP_CYCLIC=1): the facts of the functions it reads, from
+    // a rule that reads them.
+    const recurCase = (between) => ({ name, args, zero, next, lemmas: stated, between,
+        facts: uses.length ? rule(`${name}'s functions`).fns(def.fns ?? {}).inputs({}).state({ z: 0 }).step((env) => ({ z: env.z })).machine.facts ?? [] : [] });
     const failed = (what, v) => { if (!(v.proven && v.checked))
         throw new Unproven(`${name}'s ${what}`, v); };
     // The lemmas: x counting up from 0 and fx its value, each lemma a law of that machine.
@@ -1374,7 +1418,11 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         const r = r0.state({ x: 0, fx: ((p) => (zeroReads ? p.fx0 : zeroAt(args.map(a => p[a])))) })
             .step((env) => ({ x: env.x.plus(1), fx: def.next(env.x, env.fx, envAt(args.map(a => env[a]))) }));
         const laws = Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a])))));
-        verdict = proveRule(r, laws);
+        // (Its machine's proof timed alone: the recurrence is compared below as its own instance.)
+        const t0 = performance.now();
+        verdict = quietly(() => proveRule(r, laws, { search: false }));
+        if (cyclicOn())
+            crossCyclic('recurrence', name, verdict.proven && verdict.checked, () => { const { facts, specs } = recurNodes(recurCase([])); return proveCyclic(facts, specs); }, performance.now() - t0);
         failed('lemmas', verdict);
         proofs.lemmas = { machine: r.machine, laws };
     }
@@ -1411,7 +1459,9 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
             .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(at(env))) }));
         const laws = [...Object.entries(lemmas).map(([n, l]) => r.law(`${n} at y`, (env) => l(env.y, env.fy, envAt(at(env))))),
             ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env)))))];
-        const v = proveRule(r, laws);
+        const t0 = performance.now(), v = quietly(() => proveRule(r, laws, { search: false })), usualMs = performance.now() - t0;
+        if (cyclicOn())
+            crossCyclic('recurrence, between', name, v.proven && v.checked, () => { const { facts, specs } = recurNodes(recurCase(pairs)); return proveCyclic(facts, specs); }, usualMs);
         failed('laws between two points', v);
         proofs.between = { machine: r.machine, laws };
         verdict = { proven: true, checked: verdict.checked && v.checked };
@@ -1631,6 +1681,16 @@ export class Rule {
     facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
     // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
+    // Sequences each request carries (SeqRef): `.carriesSeq('Path')`, then `Path.at(i)`, `Path.len`, `A.prefixOf(B)`; the
+    // request gives each as an array of naturals.
+    carriesSeq(...names) {
+        return this.with({ carried: [...(this.spec.carried ?? []), ...names], inputs: [...this.spec.inputs, ...names.map(n => [`${n}_len`, nat])], seqs: [...(this.spec.seqs ?? []), ...names] });
+    }
+    // Tables of sequences each request carries (SeqTable): `.carriesSeqs('Paths')`, then `Paths.row(r)`, `Paths.rows`; the
+    // request gives each as an array of arrays of naturals.
+    carriesSeqs(...names) {
+        return this.with({ carried: [...(this.spec.carried ?? []), ...names.flatMap(n => [n, `${n}_base`, `${n}_len`])], inputs: [...this.spec.inputs, ...names.map(n => [`${n}_rows`, nat])], seqTables: [...(this.spec.seqTables ?? []), ...names] });
+    }
     // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
     //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
     // Each fold's start and step, and each lemma, may read the params declared before it.
@@ -1846,6 +1906,15 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            for (const n of this.spec.seqs ?? []) {
+                delete out[`${n}_len`];
+                out[n] = new SeqRef(new MapRef(n, 0), v(`${n}_len`));
+            }
+            for (const n of this.spec.seqTables ?? []) {
+                for (const part of [`${n}_base`, `${n}_len`, `${n}_rows`])
+                    delete out[part];
+                out[n] = new SeqTable(n, v(`${n}_rows`));
+            }
             const ps = Object.fromEntries(this.spec.params.map(([n]) => [n, out[n]]));
             for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
                 const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, ps, this.spec.params);
@@ -2187,16 +2256,35 @@ export class Rule {
     // --- running it -----------------------------------------------------------------------------------------------------
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
-    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural; a sequence an array of
+    // naturals, a table of them an array of such arrays.
     // A carried list is an array of its items' runtime values (its length and folds computed from them); `params`, what
     // folds that read the params are computed with.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     encodeInput(values, params) {
         const at = params && this.paramValues(this.encodeParams(params));
         const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, at).encode(values[n])]));
-        const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
+        // A sequence: its values at their positions (no 0 cell), its length; a table: the rows one after another in one map,
+        // each row's offset and length.
+        const seqMaps = {}, seqLens = {};
+        const cells = (xs, from = 0) => xs.flatMap((x, i) => (x ? [[from + i, x]] : []));
+        for (const n of this.spec.seqs ?? []) {
+            const xs = values[n] ?? [];
+            seqMaps[n] = new Map(cells(xs));
+            seqLens[`${n}_len`] = xs.length;
+        }
+        for (const n of this.spec.seqTables ?? []) {
+            const rows = values[n] ?? [], base = [];
+            rows.reduce((at, r) => (base.push(at), at + r.length), 0);
+            seqMaps[n] = new Map(rows.flatMap((r, i) => cells(r, base[i])));
+            seqMaps[`${n}_base`] = new Map(base.flatMap((b, i) => (b ? [[i, b]] : [])));
+            seqMaps[`${n}_len`] = new Map(rows.flatMap((r, i) => (r.length ? [[i, r.length]] : [])));
+            seqLens[`${n}_rows`] = rows.length;
+        }
+        const out = encode(this.spec.inputs, { ...values, ...seqLens, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
         for (const l of Object.values(lists))
             Object.assign(out, l.maps);
+        Object.assign(out, seqMaps);
         for (const n of this.spec.carried ?? []) {
             if (n in out)
                 continue;
@@ -2432,14 +2520,16 @@ const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.na
 // interpreter took. A rule that reads functions is skipped: the kernel knows them only by their facts (a recurrence's
 // induction machine reads the function it proves things about), so a run computing them proves nothing about the goal.
 const refuteBudget = { trials: 60, depth: 6, bound: 3, ms: 150 };
-function refuteByRuns(r, laws, stepLaws = []) {
+// The search's own runs, before it looks for what the laws need: deeper and wider, from another seed.
+const deeperBudget = { trials: 600, depth: 24, bound: 8, ms: 1500, seed: 29 };
+function refuteByRuns(r, laws, stepLaws = [], budget = refuteBudget) {
     const m = r.machine;
     if (Object.keys(m.fns ?? {}).length || m.facts?.length)
         return undefined;
-    const run = interpret(m), rand = seeded(13), until = performance.now() + refuteBudget.ms, bound = refuteBudget.bound;
+    const run = interpret(m), rand = seeded(budget.seed ?? 13), until = performance.now() + budget.ms, bound = budget.bound;
     const shown = (input) => Object.fromEntries(Object.entries(input).map(([n, x]) => [n, typeof x === 'number' ? x : Object.fromEntries(x)]));
     try {
-        for (let trial = 0; trial < refuteBudget.trials && performance.now() < until; trial++) {
+        for (let trial = 0; trial < budget.trials && performance.now() < until; trial++) {
             const params = r.randomParams(rand, bound);
             if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
                 continue;
@@ -2451,7 +2541,7 @@ function refuteByRuns(r, laws, stepLaws = []) {
             for (const { w, on } of watching)
                 if (!('then' in w) && !on.start(st))
                     return broken(w, '@start', st);
-            for (let d = 0, tries = 0; d < refuteBudget.depth && tries < 40; tries++) {
+            for (let d = 0, tries = 0; d < budget.depth && tries < 40; tries++) {
                 const input = r.randomInput(rand, bound, params);
                 if (!allowed(m, run, params, st, input))
                     continue;
@@ -2471,7 +2561,7 @@ function refuteByRuns(r, laws, stepLaws = []) {
         // variable of a kind is drawn as its kind draws (33 yes/nos drawn from 0..7 almost never make a lawful state).
         const steps1 = stepLaws.filter(sl => (sl.steps ?? 1) === 1), given = withKinds(r, laws);
         const wide = Object.keys(m.state).length + m.inputs.length >= 32, lawsHere = wide ? given : [], kinded = wide ? r.kindsOfState() : [];
-        for (let trial = 0; !m.history && (steps1.length || lawsHere.length) && trial < refuteBudget.trials * 4 && performance.now() < until; trial++) {
+        for (let trial = 0; !m.history && (steps1.length || lawsHere.length) && trial < budget.trials * 4 && performance.now() < until; trial++) {
             const params = r.randomParams(rand, bound);
             if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
                 continue;
@@ -2499,25 +2589,56 @@ function refuteByRuns(r, laws, stepLaws = []) {
     return undefined;
 }
 const refutedVerdict = (out) => ({ proven: false, checked: false, goal: out.goal, stuck: 'sat', witness: out.witness, ...(out.run ? { run: out.run } : {}) });
-export function proveRule(r, laws) {
+export function proveRule(r, laws, opts = {}) {
     const refuted = refuteByRuns(r, laws);
     if (refuted)
         return refutedVerdict(refuted);
     const out = proveLaws(r.machine, withKinds(r, laws));
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    const v = { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    return searched(r, laws, [], v, opts);
 }
-export function proveSteps(r, laws, stepLaws) {
+export function proveSteps(r, laws, stepLaws, opts = {}) {
     const refuted = refuteByRuns(r, laws, stepLaws);
     if (refuted)
         return refutedVerdict(refuted);
     const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    const v = { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+    return searched(r, laws, stepLaws, v, opts);
+}
+// The search, where the prover alone didn't prove the laws and nothing refuted them: the lemmas first where the rule has
+// recurrences or carried lists (the rule made again with them), then invariants over what it then is. The verdict is the
+// prover's on the laws with what was found; when nothing is found, the prover's own (with why).
+function searched(r, laws, stepLaws, v, opts) {
+    if ((v.proven && v.checked) || opts.search === false || v.run || v.stuck === 'sat' && !/@step|@\d+ steps/.test(v.goal ?? ''))
+        return v;
+    const deeper = refuteByRuns(r, laws, stepLaws, deeperBudget);
+    if (deeper?.run)
+        return refutedVerdict(deeper);
+    const until = performance.now() + (typeof opts.search === 'object' && opts.search.ms !== undefined ? opts.search.ms : 10_000);
+    let rule = r, lemmas;
+    const { fns, lists } = r.parts;
+    if (lists.length || fns.some(([, d]) => recurOf(d))) {
+        const d = withDeadline(until, () => discover(r, laws, stepLaws, v));
+        if (d.verdict.proven && d.verdict.checked)
+            return { ...d.verdict, found: { lemmas: d.found } };
+        if (Object.keys(d.found).length)
+            (rule = d.rule, lemmas = d.found);
+    }
+    const ms = until - performance.now();
+    if (ms < 500)
+        return v;
+    const inf = inferLaws(rule, laws, stepLaws, { ms, ...(rule === r ? { first: v } : {}) });
+    if (!(inf.proven && inf.checked))
+        return { ...v, why: [v.why, `the search found nothing that proves it in ${Math.round(inf.stats.ms)} ms`].filter(Boolean).join('; ') };
+    const { found, stats: _stats, ...verdict } = inf;
+    void _stats;
+    return { ...verdict, found: { laws: found, ...(lemmas ? { lemmas } : {}) } };
 }
 export function proveLeadsTo(r, laws, l) {
     const out = proveLiveness(r.machine, withKinds(r, laws), l);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
-export const proveDecision = (d) => (d.steps ? proveSteps(d.steps.rule, [], [d.steps.law]) : goalsVerdict([d.goal]));
+export const proveDecision = (d) => (d.steps ? proveSteps(d.steps.rule, [], [d.steps.law], { search: false }) : goalsVerdict([d.goal]));
 const seeded = (seed) => { let x = seed; return k => { x = (x * 1103515245 + 12345) % 2 ** 31; return Math.floor(x / 2 ** 31 * k); }; };
 // A decision's callbacks against its condition, on random params and requests: `given` and `then` each run with every
 // value known, against what the interpreter evaluates of the decision built from them.
@@ -2661,7 +2782,12 @@ export class FoldRule {
 }
 export const fold = (name) => new FoldRule({ name, params: [], inputs: [], pre: [], assume: [] });
 // A fold's laws proven over every tree (a rose fold's own laws, its children's lemmas, with them).
-export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, [...(f.lemmas ?? []), ...laws]));
+export const proveFold = (f, laws) => {
+    const all = [...(f.lemmas ?? []), ...laws], t0 = performance.now(), v = goalsVerdict(foldObligations(f.fold, all)), usualMs = performance.now() - t0;
+    if (cyclicOn())
+        crossCyclic('fold', f.fold.name, v.proven && v.checked, () => { const { facts, specs } = foldNodes(f.fold, all); return proveCyclic(facts, specs); }, usualMs);
+    return v;
+};
 const asTerm = (t) => (t instanceof Term ? t : lit(t));
 // A fold over trees whose nodes have any number of children, as the kernel's binary fold (so the kernel and Lean's
 // fold_sound check it as they check any fold): a node's children become a chain of glue nodes, each folding one child

package/dist/core/infer.js

@@ -13,10 +13,11 @@
 //     its witness is a counterexample to induction, so the candidate that rules it out (and the most of those seen) is
 //     added; a chosen candidate that nothing supports, or that makes a proof slow, is dropped; the set proven as a whole
 //     is the answer, after each chosen candidate the proof doesn't need is taken out again
+import { quietly } from "./cyclic.js";
 import { any, atMost, evalC, get, interpret, n, not, plus, same, times, x } from "./machine.js";
 import { proveRule, proveSteps } from "./dsl.js";
 import { allowed, watch } from "./watch.js";
-import { proveLaw, proveLaws, proveStepLaws } from "../kernel/prove.js";
+import { proveLaw, proveLaws, proveStepLaws, withDeadline } from "../kernel/prove.js";
 const KEY = 'key$found', AT = '@', K = '#';
 const seeded = (seed) => { let s = seed; return k => { s = (s * 1103515245 + 12345) % 2 ** 31; return Math.floor(s / 2 ** 31 * k); }; };
 const isRule = (t) => typeof t.kindsOfState === 'function';
@@ -106,13 +107,16 @@ const keyValue = (cell, w) => {
     return value;
 };
 export function inferLaws(target, laws, stepLaws = [], opts = {}) {
+    return quietly(() => withDeadline(performance.now() + (opts.ms ?? 20000), () => inferLawsSearch(target, laws, stepLaws, opts)));
+}
+function inferLawsSearch(target, laws, stepLaws = [], opts = {}) {
     const t0 = performance.now(), until = t0 + (opts.ms ?? 20000), rule = isRule(target) ? target : undefined;
     const m = rule ? rule.machine : target;
     let proofs = 0;
     const prove = (ls) => {
         proofs++;
         if (rule)
-            return stepLaws.length ? proveSteps(rule, ls, stepLaws) : proveRule(rule, ls);
+            return stepLaws.length ? proveSteps(rule, ls, stepLaws, { search: false }) : proveRule(rule, ls, { search: false });
         const out = stepLaws.length ? proveStepLaws(m, ls, stepLaws) : proveLaws(m, ls);
         return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
     };
@@ -245,16 +249,18 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
     };
     const choose = (k, of) => { let r = 1; for (let i = 0; i < k; i++)
         r = r * (of - i) / (i + 1); return r; };
-    const plain = atoms.flatMap((a, i) => (a.cell ? [] : [i])), P = plain.length;
+    // A choice's index orders its values arbitrarily: it is a guard, or alone (a bound on it reads as the values it
+    // allows), never a term among others.
+    const plain = atoms.flatMap((a, i) => (a.cell ? [] : [i])), terms = plain.filter(i => !modeOf(i)?.choice), P = terms.length;
     const scalarOk = (acc) => acc.some(([i]) => !atoms[i].param);
     pick(1, [1], plain, scalarOk, false);
-    pick(2, choose(2, P) * 4 * mags.length ** 2 <= maxCandidates / 4 ? mags : [1], plain, scalarOk, false);
+    pick(2, choose(2, P) * 4 * mags.length ** 2 <= maxCandidates / 4 ? mags : [1], terms, scalarOk, false);
     if (choose(3, P) * 8 * mags.length ** 3 <= maxCandidates / 2)
-        pick(3, mags, plain, scalarOk, false);
+        pick(3, mags, terms, scalarOk, false);
     else if (choose(3, P) * 8 <= maxCandidates / 2)
-        pick(3, [1], plain, scalarOk, false);
+        pick(3, [1], terms, scalarOk, false);
     if (cellAtoms.length) {
-        const all = atoms.map((_, i) => i), cellOk = (acc) => acc.some(([i]) => atoms[i].cell) && acc.filter(([i]) => !atoms[i].cell).length <= 1;
+        const all = atoms.flatMap((_, i) => (modeOf(i)?.choice ? [] : [i])), cellOk = (acc) => acc.some(([i]) => atoms[i].cell) && acc.filter(([i]) => !atoms[i].cell).length <= 1;
         pick(1, [1], cellAtoms, () => true, true);
         pick(2, [1], all, cellOk, true);
         if (choose(3, A) * 8 <= maxCandidates / 4)
@@ -329,7 +335,8 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
             return `${nameOf(f.unreachable.atom)} is never ${shownValue(f.unreachable.atom, f.unreachable.value)}`;
         const { l, r } = sides(f), within = allowedValues(f);
         const body = within ? `${nameOf(f.coef[0][0])} is ${within.map(v => shownValue(f.coef[0][0], v)).join(' or ')}` : `${l} <= ${r}`;
-        const guarded = !f.guard ? body : 'keyNot' in f.guard ? `k = ${nameOf(f.guard.keyNot)} or ${body}` : `${nameOf(f.guard.atom)} is ${shownValue(f.guard.atom, f.guard.value)} → ${body}`;
+        const under = f.when ? (({ l: wl, r: wr }) => `${wl} <= ${wr} → `)(sides({ coef: f.when.coef, d: f.when.d, cells: false, size: 0 })) : '';
+        const guarded = !f.guard ? under + body : 'keyNot' in f.guard ? `k = ${nameOf(f.guard.keyNot)} or ${body}` : `${nameOf(f.guard.atom)} is ${shownValue(f.guard.atom, f.guard.value)} → ${under}${body}`;
         return f.cells ? `every k: ${guarded}` : guarded;
     };
     const sum = (es) => es.reduce((p, q) => plus(p, q), n(0));
@@ -347,12 +354,13 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
         if (f.unreachable)
             return notAt(f.unreachable.atom, f.unreachable.value);
         const lhs = sum([...partsOf(f, 1), ...(f.d < 0 ? [n(-f.d)] : [])]), rhs = sum([...partsOf(f, -1), ...(f.d > 0 ? [n(f.d)] : [])]);
-        const body = atMost(lhs, rhs);
+        // Under a condition Σ ≤ d: its negation, −Σ ≤ −d − 1, or the body.
+        const body = f.when ? any(condOf({ coef: f.when.coef.map(([i, c]) => [i, -c]), d: -f.when.d - 1, cells: false, size: 0 }), atMost(lhs, rhs)) : atMost(lhs, rhs);
         return !f.guard ? body : 'keyNot' in f.guard ? any(same(x(KEY), x(atoms[f.guard.keyNot].parts[0][0])), body) : any(notAt(f.guard.atom, f.guard.value), body);
     };
     // The builder call, for a rule whose atoms are its own variables (naturals, or integers alone).
     const sourceOf = (f, text) => {
-        if (!rule)
+        if (!rule || f.when)
             return undefined;
         const used = [...new Set([...f.coef.map(([i]) => i), ...(f.guard ? ['keyNot' in f.guard ? f.guard.keyNot : f.guard.atom] : []), ...(f.unreachable ? [f.unreachable.atom] : [])])];
         const ints = f.coef.filter(([i]) => atoms[i].int).length;
@@ -388,6 +396,13 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
             else if (valueOf(atoms[f.guard.atom], env) !== f.guard.value)
                 return true;
         }
+        if (f.when) {
+            let w = 0;
+            for (const [i, c] of f.when.coef)
+                w += c * valueOf(atoms[i], env);
+            if (w > f.when.d)
+                return true;
+        }
         let s = 0;
         for (const [i, c] of f.coef)
             s += c * valueOf(atoms[i], env);
@@ -489,6 +504,97 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
         }
         return pickF;
     };
+    // A counterexample to induction no candidate rules out: forms false at it that every sample meets under a condition
+    // it meets too (one value, or a sum or difference of two, at most a threshold: 0, ±1, or its own value there), the
+    // choice (loc, say) at its value there as the guard. A condition no sample meets gives its negation instead. Only the
+    // eight values most unusual at it are read (furthest past the samples in its guard, then the rarest there).
+    const choiceMode = modes.find(mo => mo.choice && !atoms[mo.atom].cell);
+    const condAtoms = plain.filter(i => !atoms[i].param && i !== choiceMode?.atom);
+    const fromCti = (p) => {
+        const stop = Math.min(until, performance.now() + Math.max(300, (until - performance.now()) / 8));
+        const sc = p.scalar, pv = (coef) => { let v = 0; for (const [i, c] of coef)
+            v += c * valueOf(atoms[i], sc); return v; };
+        const gv = choiceMode ? valueOf(atoms[choiceMode.atom], sc) : undefined;
+        const inGuard = [];
+        for (let j = 0; j < NS; j++)
+            if (gv === undefined || valsS[choiceMode.atom][j] === gv)
+                inGuard.push(j);
+        const unusual = (i) => {
+            const v = valueOf(atoms[i], sc);
+            let lo = Infinity, hi = -Infinity, same = 0;
+            for (const j of inGuard) {
+                const w = valsS[i][j];
+                if (w < lo)
+                    lo = w;
+                if (w > hi)
+                    hi = w;
+                if (w === v)
+                    same++;
+            }
+            return [Math.max(0, lo - v, v - hi), -same];
+        };
+        const focus = condAtoms.map(i => ({ i, u: unusual(i) })).sort((a, b) => b.u[0] - a.u[0] || b.u[1] - a.u[1]).slice(0, 8).map(x => x.i);
+        // Over the focus: one or two values with the magnitudes, three with ±1.
+        const bodies = [];
+        const signed = (ks) => ks.flatMap(k => [k, -k]);
+        for (const [a, i] of focus.entries()) {
+            bodies.push({ coef: [[i, 1]] }, { coef: [[i, -1]] });
+            for (const [b2, k] of focus.slice(a + 1).entries()) {
+                for (const c1 of signed(mags))
+                    for (const c2 of signed(mags))
+                        if (gcd(c1, c2) === 1)
+                            bodies.push({ coef: [[i, c1], [k, c2]] });
+                for (const q of focus.slice(a + b2 + 2))
+                    for (const c1 of [1, -1])
+                        for (const c2 of [1, -1])
+                            for (const c3 of [1, -1])
+                                bodies.push({ coef: [[i, c1], [k, c2], [q, c3]] });
+            }
+        }
+        const conds = [];
+        for (const [a, i] of focus.entries()) {
+            conds.push([[i, 1]], [[i, -1]]);
+            for (const k of focus.slice(a + 1))
+                conds.push([[i, 1], [k, -1]], [[i, -1], [k, 1]], [[i, 1], [k, 1]]);
+        }
+        const out = [], guard = choiceMode ? { atom: choiceMode.atom, value: gv } : undefined;
+        for (const coef of conds) {
+            const here = pv(coef);
+            for (const d of [...new Set([here, 0, 1, -1])].filter(d => here <= d)) {
+                if (performance.now() > stop)
+                    break;
+                const rows = [];
+                for (const j of inGuard)
+                    if (at(coef, valsS, j) <= d)
+                        rows.push(j);
+                const when = { coef, d }, base = sizeOf(coef) + 80;
+                if (!rows.length) {
+                    out.push({ coef: coef.map(([i, c]) => [i, -c]), d: -d - 1, cells: false, ...(guard ? { guard } : {}), size: base });
+                    continue;
+                }
+                const stride = Math.max(1, Math.ceil(rows.length / 600));
+                for (const [q, sh] of bodies.entries()) {
+                    if (q % 256 === 0 && performance.now() > stop)
+                        break;
+                    const v = pv(sh.coef);
+                    let most = -Infinity, ok = true;
+                    for (let t = 0; t < rows.length; t += stride) {
+                        const w = at(sh.coef, valsS, rows[t]);
+                        if (w >= v) {
+                            ok = false;
+                            break;
+                        }
+                        if (w > most)
+                            most = w;
+                    }
+                    if (ok && Number.isFinite(most))
+                        out.push({ coef: sh.coef, d: most, cells: false, ...(guard ? { guard } : {}), when, size: base + sizeOf(sh.coef) });
+                }
+            }
+        }
+        // A stride may skip a sample that breaks a form: each is checked again at every sample in its guard.
+        return out.sort((x, y) => x.size - y.size).slice(0, 2000).filter(f => inGuard.every(j => holdsRow(f, rowsS[j]))).slice(0, 400);
+    };
     // The search proves one law at a time (proveLaw), each with every law assumed, and keeps what it proved while laws
     // are only added (more laws assumed keep a proof a proof); dropping one forgets it all. Once every law is proven so,
     // the set is proven as a whole, by the rule's own prover: that verdict is the answer.
@@ -545,7 +651,13 @@ export function inferLaws(target, laws, stepLaws = [], opts = {}) {
         const p = /@step|@\d+ steps/.test(last.goal) && last.witness ? witnessPoint(last.witness) : undefined;
         if (p)
             ctis.push(p);
-        const next = p ? best(p) : undefined;
+        let next = p ? best(p) : undefined;
+        if (!next && p) {
+            const t = performance.now(), made = fromCti(p);
+            pool.push(...made);
+            next = best(p);
+            opts.progress?.('cti', { forms: made.length, ms: Math.round(performance.now() - t) });
+        }
         if (next) {
             chosen.push(next);
             continue;

package/dist/kernel/cyclic.d.ts

@@ -0,0 +1,45 @@
+import type { C, E } from '../core/machine.js';
+import { type Goal, type Tree } from './kernel.js';
+export type Fact = {
+    name: string;
+    keys: string[];
+    holds: C;
+};
+export type Use = {
+    node: number;
+    subst: Record<string, E>;
+    guard: C;
+    premises: Tree[];
+    descent: Tree;
+};
+export type CNode = {
+    name: string;
+    hyps: C[];
+    concl: C;
+    rank: E[];
+    insts: {
+        fact: number;
+        at: E[];
+    }[];
+    uses: Use[];
+    main: Tree;
+};
+export type Cyclic = {
+    facts: Fact[];
+    nodes: CNode[];
+};
+export declare const falseC: C;
+export declare const lexLt: (as: E[], bs: E[]) => C;
+export declare const instHyps: (facts: Fact[], insts: CNode["insts"]) => C[];
+export declare const baseHyps: (facts: Fact[], n: Pick<CNode, "hyps" | "insts">) => C[];
+export declare const useHyps: (nodes: Pick<CNode, "concl">[], uses: Pick<Use, "node" | "subst" | "guard">[]) => C[];
+type Shape = Pick<CNode, 'name' | 'hyps' | 'concl' | 'rank' | 'insts'> & {
+    uses: Pick<Use, 'node' | 'subst' | 'guard'>[];
+};
+export declare const mainGoal: (facts: Fact[], nodes: Shape[], n: Shape) => Goal;
+export declare const premiseGoal: (facts: Fact[], n: Shape, u: Shape["uses"][number], c: C, i: number) => Goal;
+export declare const descentGoal: (facts: Fact[], n: Shape, u: Shape["uses"][number], m: Shape) => Goal;
+export declare const factsAvoid: (facts: Fact[], subst: Record<string, E>) => boolean;
+export declare function refuseCyclic(p: Cyclic): string | undefined;
+export declare const checkCyclic: (p: Cyclic) => boolean;
+export {};

package/dist/kernel/cyclic.js

@@ -0,0 +1,54 @@
+import { check, substC, substE } from "./kernel.js";
+const zero = { op: 'const', value: 0 };
+export const falseC = { op: '<', a: zero, b: zero };
+// as below bs in order: the first place they differ, as's is smaller (Lean's lexLtC, built the same way).
+export const lexLt = (as, bs) => (as.length && bs.length
+    ? { op: 'or', xs: [{ op: '<', a: as[0], b: bs[0] }, { op: 'and', xs: [{ op: '=', a: as[0], b: bs[0] }, lexLt(as.slice(1), bs.slice(1))] }] }
+    : falseC);
+const sub = (s) => ({ vars: s, maps: {}, flags: {} });
+// A fact at the terms a node names: its keys paired with the terms (the shorter list decides, as Lean's zip does).
+const keyed = (keys, at) => Object.fromEntries(keys.slice(0, at.length).map((key, i) => [key, at[i]]));
+export const instHyps = (facts, insts) => insts.flatMap(p => { const f = facts[p.fact]; return f ? [substC(f.holds, sub(keyed(f.keys, p.at)))] : []; });
+export const baseHyps = (facts, n) => [...n.hyps, ...instHyps(facts, n.insts)];
+export const useHyps = (nodes, uses) => uses.flatMap(u => {
+    const m = nodes[u.node];
+    return m ? [{ op: 'or', xs: [{ op: 'not', x: u.guard }, substC(m.concl, sub(u.subst))] }] : [];
+});
+export const mainGoal = (facts, nodes, n) => ({ name: `${n.name}`, hyps: [...baseHyps(facts, n), ...useHyps(nodes, n.uses), { op: 'not', x: n.concl }] });
+export const premiseGoal = (facts, n, u, c, i) => ({ name: `${n.name}: use of node ${u.node}, its hypothesis ${i}`, hyps: [...baseHyps(facts, n), u.guard, { op: 'not', x: substC(c, sub(u.subst)) }] });
+export const descentGoal = (facts, n, u, m) => ({ name: `${n.name}: use of node ${u.node}, its rank below`, hyps: [...baseHyps(facts, n), u.guard, { op: 'not', x: lexLt(m.rank.map(e => substE(e, sub(u.subst))), n.rank) }] });
+const occurs = (name, t) => JSON.stringify(t).includes(`"op":"var","name":${JSON.stringify(name)}`);
+// The language Lean's twin has: no flag, no quantifier.
+const plain = (t) => !/"op":"(?:flag|all)"/.test(JSON.stringify(t));
+export const factsAvoid = (facts, subst) => Object.keys(subst).every(v => facts.every(f => f.keys.includes(v) || !occurs(v, f.holds)));
+// Why a cyclic proof is refused, or undefined when it checks.
+export function refuseCyclic(p) {
+    const { facts, nodes } = p;
+    if (!plain(facts) || !plain(nodes.map(n => [n.hyps, n.concl, n.rank, n.insts, n.uses.map(u => [u.subst, u.guard])])))
+        return 'a flag or a quantifier (no cyclic proof reads one)';
+    for (const f of facts)
+        if (new Set(f.keys).size !== f.keys.length)
+            return `fact ${f.name}: a key twice`;
+    for (const n of nodes) {
+        if (!check(mainGoal(facts, nodes, n), n.main))
+            return `${n.name}: its goal`;
+        for (const [j, u] of n.uses.entries()) {
+            const m = nodes[u.node];
+            if (!m)
+                return `${n.name}: use ${j} names no node`;
+            if (m.rank.length !== n.rank.length)
+                return `${n.name}: use ${j} compares ranks of different lengths`;
+            if (!factsAvoid(facts, u.subst))
+                return `${n.name}: use ${j} assigns a variable a fact reads`;
+            if (m.hyps.length !== u.premises.length)
+                return `${n.name}: use ${j} has ${u.premises.length} premise trees for ${m.hyps.length} hypotheses`;
+            for (const [i, c] of m.hyps.entries())
+                if (!check(premiseGoal(facts, n, u, c, i), u.premises[i]))
+                    return `${n.name}: use ${j}, hypothesis ${i} of ${m.name}`;
+            if (!check(descentGoal(facts, n, u, m), u.descent))
+                return `${n.name}: use ${j} doesn't lower the rank`;
+        }
+    }
+    return undefined;
+}
+export const checkCyclic = (p) => refuseCyclic(p) === undefined;

package/dist/kernel/prove.d.ts

@@ -21,6 +21,11 @@ export declare const solveKinds: Record<string, {
     ms: number;
     rows: number;
 }>;
+export declare let proveDump: ((goal: Goal) => void) | undefined;
+export declare const setProveDump: (f: ((goal: Goal) => void) | undefined) => void;
+export declare const cellProducts: {
+    on: boolean;
+};
 export type Outcome = {
     tree: Tree;
     nodes: number;
@@ -30,10 +35,15 @@ export type Outcome = {
     path: Path;
     why?: string;
 };
+export declare function withDeadline<T>(until: number, f: () => T): T;
 export declare function grow(goal: Goal, path?: Path, budget?: {
     nodes: number;
     until?: number;
+    units?: boolean;
 }): Outcome;
+export declare const minimal: {
+    on: boolean;
+};
 export type Report = {
     proven: boolean;
     nodes: number;