gdp-wired 0.16.0 → 0.18.0

package/dist/lean-kernel/emit.d.ts

@@ -1,6 +1,7 @@
 import type { C, E, Law, Machine, Recurrence } from '../core/machine.js';
 import { type Lin, type Step } from '../core/solver.js';
 import { type Fold, type Goal, type Instances, type Liveness, type Loop, type Path, type StepLaw, type Tree } from '../kernel/kernel.js';
+import { type Cyclic } from '../kernel/cyclic.js';
 import { leanLibrary } from './library.js';
 export { leanLibrary };
 export type Exported = {
@@ -36,6 +37,7 @@ export declare function readable(id: string, laws: Law[], vars: string[], maps:
     binders: string;
     hyp: string;
     call: string;
+    have?: (j: number) => string;
 }): string;
 export type ProgressCase = {
     id: string;
@@ -60,6 +62,10 @@ export declare function mmachineToLean(id: string, m: Machine, laws: Law[], opts
     stepLaws?: StepLaw[];
 }): string;
 export declare const hasSets: (m: Machine) => boolean;
+export declare function machineLit(mm: Machine, t: {
+    e: (x: E) => string;
+    c: (x: C) => string;
+}, ix: (name: string) => number, mx: (name: string) => number): string;
 export declare function smachineToLean(id: string, given: Machine, laws: Law[], opts?: {
     stepLaws?: StepLaw[];
     liveness?: Liveness[];
@@ -143,6 +149,21 @@ export type LeanItem = {
 } | {
     id: string;
     goal: Goal;
+} | {
+    id: string;
+    cyclic: Cyclic;
+    tampered?: {
+        what: string;
+        proof: Cyclic;
+    }[];
+    after?: (ix: (name: string) => number, mx: (map: string) => number) => string;
+    bridge?: CycBridge;
+    recur?: CycRecur;
+    fold?: {
+        fold: Fold;
+        laws: Law[];
+    };
+    data?: true;
 };
 export declare function toLean(items: LeanItem[], opts?: {
     title?: string;
@@ -151,3 +172,55 @@ export declare function toLean(items: LeanItem[], opts?: {
 export declare function leanProject(file: string, opts?: {
     name?: string;
 }): Record<string, string>;
+export type CycBridge = {
+    machine: Machine;
+    laws: Law[];
+    tampered?: {
+        what: string;
+        machine: Machine;
+    }[];
+};
+export type CycRecur = {
+    name: string;
+    args: string[];
+    zero: E;
+    next: E;
+    lemmas: {
+        name: string;
+        holds: C;
+    }[];
+    between: {
+        name: string;
+        holds: C;
+    }[];
+};
+export declare function cyclicToLean(id: string, p: Cyclic, tampered?: {
+    what: string;
+    proof: Cyclic;
+}[], after?: (ix: (name: string) => number, mx: (map: string) => number) => string, bridge?: CycBridge, recur?: CycRecur, fold?: {
+    fold: Fold;
+    laws: Law[];
+}): string;
+export declare function cycEncodingLean(id: string, facts: {
+    name: string;
+    keys: string[];
+    holds: C;
+}[], nodes: {
+    name: string;
+    hyps: C[];
+    concl: C;
+}[], b: CycBridge): string;
+export declare function cycRecurCheckLean(id: string, facts: {
+    name: string;
+    keys: string[];
+    holds: C;
+}[], r: CycRecur): string;
+export declare function cycFoldCheckLean(id: string, facts: {
+    name: string;
+    keys: string[];
+    holds: C;
+}[], nodes: {
+    name: string;
+    hyps: C[];
+    concl: C;
+}[], f: Fold, laws: Law[]): string;

package/dist/lean-kernel/emit.js

@@ -1,9 +1,10 @@
 import { atMost, n, not, pointWrite } from "../core/machine.js";
 import { add, k, scale, sub } from "../core/solver.js";
 import { boundOf, canon, factorsOf, isCell, isMonomial, columnTerm, stateName, termColumn, historyMachine, foldObligations, leafConstraints, loopLiveness, loopMachine, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, witnessesOf, withProducts } from "../kernel/kernel.js";
-import { grow, proveBuilt, proveLaws, proveStepLaws } from "../kernel/prove.js";
+import { grow, minimal, proveBuilt, proveLaws, proveStepLaws } from "../kernel/prove.js";
 import { refinement, refinementSides } from "../core/compose.js";
 import { leanSurface, leanTerms } from "./lean-terms.js";
+import { descentGoal, mainGoal, premiseGoal } from "../kernel/cyclic.js";
 import { leanLibrary } from "./library.js";
 export { leanLibrary };
 // --- to Lean ------------------------------------------------------------------------------------------------------------
@@ -130,12 +131,24 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
     // monomial with a cell among its factors after the cells.
     const degree = (a, b) => factorsOf(a).length - factorsOf(b).length;
     const plainMonos = [...monos].filter(m => factorsOf(m).every(f => !isCell(f))).sort(degree), cellMonos = [...monos].filter(m => factorsOf(m).some(isCell)).sort(degree);
-    const cols = [...vars, ...plainMonos, ...[...terms].sort((a, b) => Number(a.slice(1, -1)) - Number(b.slice(1, -1))), ...[...cells].sort((a, b) => depth(a) - depth(b)), ...cellMonos];
+    // A cell whose key reads a product of cells (a cyclic proof's map at u + k·Ω, its key k read from a map over time)
+    // comes after that product, and the product after its cells: each column placed after the columns it reads.
+    const late = [], placed = new Set();
+    const place = (name) => {
+        if (placed.has(name))
+            return;
+        placed.add(name);
+        for (const d of isMonomial(name) ? factorsOf(name) : Object.keys(cellKey(name)))
+            if (cells.has(d) || cellMonos.includes(d))
+                place(d);
+        late.push(name);
+    };
+    for (const cell of [...cells].sort((a, b) => depth(a) - depth(b)))
+        place(cell);
+    for (const mono of cellMonos)
+        place(mono);
+    const cols = [...vars, ...plainMonos, ...[...terms].sort((a, b) => Number(a.slice(1, -1)) - Number(b.slice(1, -1))), ...late];
     const col = new Map(cols.map((name, j) => [name, j]));
-    for (const cell of cells)
-        for (const key of Object.keys(cellKey(cell)))
-            if (cellMonos.includes(key))
-                throw new Error(`${ex.name}: the key of ${cell} reads a product of cells`);
     const maps = globalMaps ?? [...new Set([...[...cells].map(cellMap), ...goal.hyps.flatMap(h => [...JSON.stringify(h).matchAll(/"op":"get","map":"([^"]+)"/g)].map(m => m[1]))])];
     const dense = (lin) => {
         const coefs = new Array(cols.length).fill(0);
@@ -320,6 +333,7 @@ theorem ${id}_laws : ∀ maps ρ, evalC ρ maps ${id}_fold.pre = true → ∀ t,
 // Readable corollaries: each law as a plain Lean statement over named variables (ρ the state, μ the maps, each name an
 // abbreviation for its column), proven from the machine's theorem by unfolding the law's own definition. The statement
 // is what a Lean development cites; the column numbers stay inside the namespace.
+// `have`: the line that gives each law as a hypothesis hl (an SEntry's Holds by default; a cyclic proof's, holdsOver).
 export function readable(id, laws, vars, maps, reach) {
     for (const name of [...vars, ...maps])
         if (name === 'ρ' || name === 'μ' || name.includes('«') || name.includes('»'))
@@ -362,8 +376,8 @@ export function readable(id, laws, vars, maps, reach) {
 ${[...vars.filter(v => used.has(v)).map(v => `abbrev ${q(v)} : Nat := ${vars.indexOf(v)}`), ...maps.filter(mp => used.has(mp)).map(mp => `abbrev ${q(mp)} : Nat := ${maps.indexOf(mp)}`)].join('\n')}
 ${laws.map((law, j) => (law.stated ? `-- ${law.name}: as written, with some key; proven (below) with the prover's witness in place\n` : '') + (JSON.stringify(law.holds).includes('"op":"if"') ? `-- ${law.name}: its terms read an if, so no plain statement here (${id}_laws holds it)` : `/-- ${law.name.replace(/-\//g, '- /')} -/
 theorem law${j} ${reach.binders} (h : ${reach.hyp}) : ${statement(law)} := by
-  ${law.keys?.length ? `have hl : ${id}_e${j}.Holds ρ μ := ${reach.call} ${id}_e${j} (by simp [${id}_proof])
-  exact fun k ${law.keys.map((_, i) => `k${i + 2}`).join(' ')} => (evalC_iff (upd (${law.keys.reduce((acc, key, i) => `upd (${acc}) ${vars.indexOf(key)} k${i + 2}`, 'ρ')}) ${vars.indexOf(law.forall)} k) μ ${id}_l${j}.holds).mp (hl ${law.keys.map((_, i) => `k${i + 2}`).join(' ')} k)` : `have hl : ${id}_l${j}.Holds ρ μ := ${reach.call} ${id}_e${j} (by simp [${id}_proof])
+  ${law.keys?.length ? `${reach.have ? reach.have(j) : `have hl : ${id}_e${j}.Holds ρ μ := ${reach.call} ${id}_e${j} (by simp [${id}_proof])`}
+  exact fun k ${law.keys.map((_, i) => `k${i + 2}`).join(' ')} => (evalC_iff (upd (${law.keys.reduce((acc, key, i) => `upd (${acc}) ${vars.indexOf(key)} k${i + 2}`, 'ρ')}) ${vars.indexOf(law.forall)} k) μ ${id}_l${j}.holds).mp (hl ${law.keys.map((_, i) => `k${i + 2}`).join(' ')} k)` : `${reach.have ? reach.have(j) : `have hl : ${id}_l${j}.Holds ρ μ := ${reach.call} ${id}_e${j} (by simp [${id}_proof])`}
   ${law.forall ? `exact fun k => (evalC_iff (upd ρ ${vars.indexOf(law.forall)} k) μ ${id}_l${j}.holds).mp (hl k)` : `exact (evalC_iff ρ μ ${id}_l${j}.holds).mp hl`}`}`)).join('\n')}
 end ${id}`;
 }
@@ -510,6 +524,25 @@ const boundKeys = (m) => [...Object.values(m.step.flags ?? {}).flatMap(c => (c.o
 // the relations assumed), built in Lean from the machine and its history (History.lean's HMachine.plain), so every claim
 // below is about it; with the relations' record goals, its laws hold over histories too (hmachine_sound).
 // `historyTampers`: the history with other relations, each refused.
+// A machine as Sets.lean's SMachine literal: its variables and maps numbered by `ix` and `mx`, its terms by `t`.
+export function machineLit(mm, t, ix, mx) {
+    const { e, c } = t;
+    const fl = flagsOfM(mm), fs = Object.entries(mm.step.flags ?? {}), ws = Object.entries(mm.step.maps ?? {});
+    return `⟨⟨⟨${list(mm.inputs.map(name => String(ix(name))))},
+  ${list(Object.entries(mm.state).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
+  ${list(Object.entries(mm.maps ?? {}).map(([name, c2]) => `(${mx(name)}, ${c2})`))},
+  ${list(Object.entries(mm.step.state ?? {}).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
+  ${list(ws.flatMap(([name, w]) => ('each' in w ? [] : [`(${mx(name)}, ${e(w.key)}, ${e(w.value)})`])))},
+  ${mm.pre ? c(mm.pre) : TRUE},
+  ${mm.assume ? c(mm.assume) : TRUE}⟩,
+  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [] : [`(${ix(`?${f}`)}, ${c(fl[f])})`])))}⟩,
+  ${list((mm.inputMaps ?? []).map(mp => String(mx(mp))))},
+  ${list(ws.flatMap(([name, w]) => ('each' in w ? [`(${mx(name)}, ${ix(w.each)}, ${e(w.value)})`] : [])))},
+  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${list(boundOf(c2).map(key => String(ix(key))))}, ${c(c2.c)})`] : [])))},
+  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${list(witnessesOf(f, c2).map(w => String(ix(w))))})`] : [])))},
+  ${list((mm.facts ?? []).filter(l => !l.keys?.length).map(l => `⟨${c(l.holds)}, ${l.forall ? `some ${ix(l.forall)}` : 'none'}⟩`))},
+  ${list((mm.facts ?? []).filter(l => l.keys?.length).map(l => `(⟨${c(l.holds)}, some ${ix(l.forall)}⟩, ${list(l.keys.map(k2 => String(ix(k2))))})`))}⟩`;
+}
 export function smachineToLean(id, given, laws, opts = {}) {
     const hm = given.history ? { ...given, history: { ...given.history, prune: undefined } } : undefined;
     const hplain = hm ? historyMachine(hm) : undefined, stepLaws = opts.stepLaws ?? [], rf = opts.refined, gv = opts.ghosts ?? [];
@@ -697,23 +730,7 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
     const mx = (name) => { const j = mapNames.indexOf(name); if (j < 0)
         throw new Error(`${id}: no map for ${name}`); return j; };
     const inline = (c2) => substC(c2, { vars: {}, maps: {}, flags: flagsOfM(m) });
-    const lit = (mm) => {
-        const fl = flagsOfM(mm), fs = Object.entries(mm.step.flags ?? {}), ws = Object.entries(mm.step.maps ?? {});
-        return `⟨⟨⟨${list(mm.inputs.map(name => String(ix(name))))},
-  ${list(Object.entries(mm.state).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
-  ${list(Object.entries(mm.maps ?? {}).map(([name, c2]) => `(${mx(name)}, ${c2})`))},
-  ${list(Object.entries(mm.step.state ?? {}).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
-  ${list(ws.flatMap(([name, w]) => ('each' in w ? [] : [`(${mx(name)}, ${e(w.key)}, ${e(w.value)})`])))},
-  ${mm.pre ? c(mm.pre) : TRUE},
-  ${mm.assume ? c(mm.assume) : TRUE}⟩,
-  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [] : [`(${ix(`?${f}`)}, ${c(fl[f])})`])))}⟩,
-  ${list((mm.inputMaps ?? []).map(mp => String(mx(mp))))},
-  ${list(ws.flatMap(([name, w]) => ('each' in w ? [`(${mx(name)}, ${ix(w.each)}, ${e(w.value)})`] : [])))},
-  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${list(boundOf(c2).map(key => String(ix(key))))}, ${c(c2.c)})`] : [])))},
-  ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${list(witnessesOf(f, c2).map(w => String(ix(w))))})`] : [])))},
-  ${list((mm.facts ?? []).filter(l => !l.keys?.length).map(l => `⟨${c(l.holds)}, ${l.forall ? `some ${ix(l.forall)}` : 'none'}⟩`))},
-  ${list((mm.facts ?? []).filter(l => l.keys?.length).map(l => `(⟨${c(l.holds)}, some ${ix(l.forall)}⟩, ${list(l.keys.map(k2 => String(ix(k2))))})`))}⟩`;
-    };
+    const lit = (mm) => machineLit(mm, { e, c }, ix, mx);
     // A loop as Live.lean's record: inputs, start, body, while, precondition, assumption.
     const loopLit = (lp) => `⟨${list(lp.inputs.map(name => String(ix(name))))},
   ${list(Object.entries(lp.state).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
@@ -1055,11 +1072,15 @@ export function toLean(items, opts = {}) {
     const outer = checkBy;
     const env = globalThis.process?.env;
     checkBy = (opts.native ?? env?.GDP_LEAN_NATIVE === '1') ? 'native_decide' : 'decide +kernel';
+    // The proofs found with only the instances their leaves use: the same laws, from fewer hypotheses for Lean to build.
+    const wasMinimal = minimal.on;
+    minimal.on = true;
     try {
         return toLeanWith(items, opts);
     }
     finally {
         checkBy = outer;
+        minimal.on = wasMinimal;
     }
 }
 function toLeanWith(items, opts) {
@@ -1119,6 +1140,12 @@ function toLeanWith(items, opts) {
             parts.push(`-- ${item.id}\n${loopToLean(id, item.loop, item.laws ?? [], item.rank)}`);
             theorems.push(`${id}_halts`);
         }
+        else if ('cyclic' in item) {
+            parts.push(`-- ${item.id}\n${cyclicToLean(id, item.cyclic, item.tampered ?? [], item.after, item.bridge, item.recur, item.fold)}`);
+            theorems.push(`${id}_sound`, ...(item.bridge?.laws ?? item.fold?.laws ?? []).map((_, j) => `${id}_law${j}_holds`), ...(item.recur ? [`${id}_values`] : []), ...(item.recur ? [...item.recur.lemmas.map((_, j) => `${id}_lemma${j}`), ...item.recur.between.map((_, j) => `${id}_between${j}`)] : []), 
+            // A datatype law's theorem is in a namespace of the item's (its datatypes and functions are named as declared).
+            ...(item.after ? (ts => (item.data ? ts.slice(-1).map(t => `${id}.${t}`) : ts))([...item.after(() => 0, () => 0).matchAll(/^theorem (\S+)/gm)].map(x2 => x2[1])) : []));
+        }
         else if ('fold' in item) {
             parts.push(`-- ${item.id}\n${foldToLean(id, item.fold, item.laws)}`);
             theorems.push(`${id}_laws`);
@@ -1132,7 +1159,7 @@ function toLeanWith(items, opts) {
     }
     // The file the items need: Live.lean for a liveness or a loop, Sets.lean (which imports Steps.lean) for any machine.
     return `import History
-import ${items.some(item => 'refinement' in item) ? 'Refine' : items.some(item => 'machine' in item && item.ghosts?.length) ? 'Ghost' : items.some(item => ('machine' in item && item.liveness?.length) || 'loop' in item) ? 'Live' : items.some(item => 'machine' in item) ? 'Sets' : 'Steps'}
+${items.some(item => 'cyclic' in item) ? (items.some(item => 'cyclic' in item && (item.bridge || item.recur || item.fold)) ? 'import Bridge\n' : 'import Cyclic\n') : ''}${items.some(item => 'cyclic' in item && item.data) ? 'import Data\n' : ''}import ${items.some(item => 'refinement' in item) ? 'Refine' : items.some(item => 'machine' in item && item.ghosts?.length) ? 'Ghost' : items.some(item => ('machine' in item && item.liveness?.length) || 'loop' in item) ? 'Live' : items.some(item => 'machine' in item) ? 'Sets' : 'Steps'}
 open Kern Cert
 set_option maxRecDepth 100000
 set_option maxHeartbeats 0
@@ -1164,3 +1191,200 @@ lean_lib ${name} where
 `,
     };
 }
+export function cyclicToLean(id, p, tampered = [], after, bridge, recur, fold) {
+    const all = [p, ...tampered.map(t => t.proof)];
+    const v = (name) => ({ op: 'var', name });
+    const fnames = fold ? Object.keys(fold.fold.leaf) : [];
+    const { vars, maps } = cycScope(all, bridge, [...(recur ? [recur.zero, recur.next, v('x'), v('prev'), v('k$'), ...recur.args.map(v)] : []),
+        ...(fold ? [...fold.fold.params, ...fold.fold.inputs, ...fnames, ...fnames.map(x => `l_${x}`), ...fnames.map(x => `r_${x}`), 'n$', 'N$'].map(v) : []),
+        ...(fold ? [...Object.values(fold.fold.leaf), ...Object.values(fold.fold.node), ...fold.laws.map((l) => ({ op: 'if', c: l.holds, then: v('n$'), else: v('n$') }))] : []),
+        ...(fold ? ['Kind', 'Left', 'Right', ...fnames, ...fold.fold.inputs].map((x) => ({ op: 'get', map: `${x}@`, key: v('n$') })) : [])]);
+    const { e, c } = leanTerms(vars, maps, id);
+    const ix = (name) => vars.indexOf(name);
+    const facts = list(p.facts.map(f => `⟨${list(f.keys.map(key => String(ix(key))))}, ${c(f.holds)}⟩`));
+    // A tampered proof keeps the proof's tables and trees (made for the proof's own goals) under its changed nodes.
+    const enc = (g, tree) => { const x = encode({ name: `${id}: ${g.name}`, goal: g, tree }, false, true, vars, maps); return `(${x.tab}, ${x.tree})`; };
+    const nodeLits = (q) => q.nodes.map((n, i) => {
+        const o = p.nodes[i];
+        const uses = n.uses.map((u, j) => {
+            const ou = o.uses[j], om = p.nodes[ou.node];
+            return `⟨${u.node}, ${list(Object.entries(u.subst).map(([name, t]) => `(${ix(name)}, ${e(t)})`))}, ${c(u.guard)},\n  ${list(om.hyps.map((h, k2) => enc(premiseGoal(p.facts, o, ou, h, k2), ou.premises[k2])))},\n  ${enc(descentGoal(p.facts, o, ou, om), ou.descent)}⟩`;
+        });
+        return { hyps: list(n.hyps.map(c)), concl: c(n.concl), rest: `${list(n.rank.map(e))}, ${list(n.insts.map(t => `(${t.fact}, ${list(t.at.map(e))})`))},\n  ${list(uses)},\n  ${enc(mainGoal(p.facts, p.nodes, o), o.main)}` };
+    });
+    const nodes = (q) => list(nodeLits(q).map(x => `⟨${x.hyps}, ${x.concl}, ${x.rest}⟩`));
+    const mx = (map) => maps.indexOf(map);
+    return `-- ${p.nodes.map(n => n.name).join('; ')}  (variables ${vars.map((name, j) => `${j} ${name}`).join(', ')}; maps ${maps.map((name, j) => `${j} ${name}`).join(', ')})
+def ${id}_facts : List Fact := ${facts}
+${nodeLits(p).map((x, i) => `def ${id}_hyps${i} : List C := ${x.hyps}
+def ${id}_concl${i} : C := ${x.concl}
+def ${id}_node${i} : CNode := ⟨${id}_hyps${i}, ${id}_concl${i}, ${x.rest}⟩
+theorem ${id}_node${i}_hyps : ${id}_node${i}.hyps = ${id}_hyps${i} := rfl
+theorem ${id}_node${i}_concl : ${id}_node${i}.concl = ${id}_concl${i} := rfl`).join('\n')}
+def ${id}_nodes : List CNode := ${list(p.nodes.map((_, i) => `${id}_node${i}`))}
+${p.nodes.map((_, i) => `theorem ${id}_node${i}_mem : ${id}_node${i} ∈ ${id}_nodes := by simp only [${id}_nodes, List.mem_cons, true_or, or_true]`).join('\n')}
+theorem ${id}_check : checkCyclic ${id}_facts ${id}_nodes = true := by ${checkBy}
+theorem ${id}_sound : ∀ (maps : Nat → Nat → Nat) env, FactsHold ${id}_facts env maps → ∀ n ∈ ${id}_nodes, (∀ c ∈ n.hyps, evalC env maps c = true) → evalC env maps n.concl = true :=
+  cyclic_sound ${id}_facts ${id}_nodes ${id}_check
+${tampered.map((t, j) => `-- TAMPERED: ${t.what}. Lean computes the check to false.
+def ${id}_tampered${j} : List CNode := ${nodes(t.proof)}
+example : checkCyclic ${id}_facts ${id}_tampered${j} = false := by ${checkBy}`).join('\n')}${bridge ? `\n${cycBridgeLean(id, p, bridge, vars, maps, { e, c })}` : ''}${recur ? `\n${cycRecurLean(id, p, recur, vars, maps, { e, c })}` : ''}${fold ? `\n${cycFoldLean(id, fold.fold, fold.laws, vars, maps, { e, c })}` : ''}${after ? `\n${after(ix, mx)}` : ''}`;
+}
+function cycScope(all, bridge, extra = []) {
+    const names = (t) => [...JSON.stringify(t).matchAll(/"op":"var","name":"([^"]+)"/g)].map(m => m[1]);
+    const ms = bridge ? [bridge.machine, ...(bridge.tampered ?? []).map(t => t.machine)] : [];
+    const keysOf = (l) => [...(l.forall ? [l.forall] : []), ...(l.keys ?? [])];
+    const traced = (m) => [...Object.keys(m.state), ...m.inputs], tracedMaps = (m) => [...Object.keys(m.maps ?? {}), ...(m.inputMaps ?? [])];
+    const machineVars = ms.flatMap(m => [...m.params, ...m.inputs, ...Object.keys(m.state), ...Object.keys(m.step.flags ?? {}).map(f => `?${f}`),
+        ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : [])), ...(m.facts ?? []).flatMap(keysOf), ...names([m.state, m.step, m.pre, m.assume, m.facts])]);
+    const vars = [...new Set([...all.flatMap(q => [...q.facts.flatMap(f => [...f.keys, ...names(f.holds)]), ...q.nodes.flatMap(n => [...names([n.hyps, n.concl, n.rank, n.insts]), ...n.uses.flatMap(u => [...Object.keys(u.subst), ...names([u.subst, u.guard])])])]),
+            ...machineVars, ...(bridge ? [...bridge.laws.flatMap(l => [...keysOf(l), ...names(l.holds)]), 'u$', 'k$', 'T$', 'O$', 't$'] : []), ...names(extra)])];
+    const maps = [...new Set([...[...JSON.stringify([all, ms, bridge?.laws ?? []]).matchAll(/"op":"get","map":"([^"]+)"/g)].map(m => m[1]),
+            ...ms.flatMap(m => [...tracedMaps(m), ...Object.keys(m.fns ?? {}), ...traced(m).map(x => `${x}@`), ...tracedMaps(m).map(x => `${x}@`)])])];
+    return { vars, maps };
+}
+// Bridge.lean's cycMOk alone, part by part, for each law of a machine (the sweep research/cyclic/bridge.ts runs over the
+// examples): the facts and nodes machineNodes makes, each node with no proof (cycMOk reads only its hypotheses and
+// conclusion), against the machine's encoding. Each part an example, named in a comment before it.
+export function cycEncodingLean(id, facts, nodes, b) {
+    const shape = { facts, nodes: nodes.map(n => ({ hyps: n.hyps, concl: n.concl, rank: [], insts: [], uses: [] })) };
+    const { vars, maps } = cycScope([shape], b);
+    const t = leanTerms(vars, maps, id);
+    const ix = (name) => { const j = vars.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no variable for ${name}`); return j; };
+    const mx = (name) => { const j = maps.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no map for ${name}`); return j; };
+    const m = b.machine, keysOf = (l) => list([...(l.forall ? [l.forall] : []), ...(l.keys ?? [])].map(k2 => String(ix(k2))));
+    const by = checkBy;
+    return `-- ${id}: ${m.name}
+def ${id}_machine : SMachine := ${machineLit(m, t, ix, mx)}
+def ${id}_enc : CycEnc := ⟨${['u$', 'k$', 'T$', 'O$', 't$'].map(ix).join(', ')},
+  ${list([...Object.keys(m.state), ...m.inputs].map(x => `(${ix(x)}, ${mx(`${x}@`)})`))},
+  ${list([...Object.keys(m.maps ?? {}), ...(m.inputMaps ?? [])].map(x => `(${mx(x)}, ${mx(`${x}@`)})`))}⟩
+${facts.map((f, i) => `-- CHECK ${id} fact ${i}: ${f.name}
+example : (natC (${t.c(f.holds)}) || (cycCanon ${id}_machine ${id}_enc).any (factBeq ⟨${list(f.keys.map(k2 => String(ix(k2))))}, ${t.c(f.holds)}⟩)) = true := by ${by}`).join('\n')}
+${b.laws.map((l, j) => `-- CHECK ${id} law ${j}: shape: ${l.name}
+example : cycShapeOk ${id}_machine ${id}_enc ${keysOf(l)} = true := by ${by}
+-- CHECK ${id} law ${j}: terms: ${l.name}
+example : cycTermsOk ${id}_machine ${id}_enc ${keysOf(l)} = true := by ${by}
+-- CHECK ${id} law ${j}: law: ${l.name}
+example : cycLawOk ${id}_machine ${id}_enc (${t.c(l.holds)}) = true := by ${by}
+-- CHECK ${id} law ${j}: node: ${l.name}
+example : cycNodeOk ${id}_machine ${id}_enc (${t.c(l.holds)}) ⟨${list(nodes[j].hyps.map(t.c))}, ${t.c(nodes[j].concl)}, [], [], [], ([], .leaf [] [] [] [])⟩ = true := by ${by}`).join('\n')}`;
+}
+// Bridge.lean's recOk and foldOk alone, for the sweep (research/cyclic/bridge.ts): recurNodes' and foldNodes' facts (and
+// a fold's nodes, with no proof: foldOk reads only their hypotheses and conclusions) against the recurrence's equations
+// and the fold's table. Each an example, named in a comment before it.
+export function cycRecurCheckLean(id, facts, r) {
+    const v = (name) => ({ op: 'var', name });
+    const { vars, maps } = cycScope([{ facts, nodes: [] }], undefined, [r.zero, r.next, v('x'), v('prev'), v('k$'), ...r.args.map(v), { op: 'get', map: `${r.name}$`, key: v('x') }]);
+    const t = leanTerms(vars, maps, id), ix = (n2) => vars.indexOf(n2), mx = (n2) => maps.indexOf(n2);
+    return `-- CHECK ${id} recurrence: ${r.name}
+example : recOk ⟨${mx(`${r.name}$`)}, ${ix('x')}, ${ix('prev')}, ${ix('k$')}⟩ (${t.e(r.zero)}) (${t.e(r.next)}) []
+    ${list(facts.map(f => `⟨${list(f.keys.map(k2 => String(ix(k2))))}, ${t.c(f.holds)}⟩`))} = true := by ${checkBy}`;
+}
+export function cycFoldCheckLean(id, facts, nodes, f, laws) {
+    const v = (name) => ({ op: 'var', name }), st = Object.keys(f.leaf);
+    const shape = { facts, nodes: nodes.map(n => ({ hyps: n.hyps, concl: n.concl, rank: [], insts: [], uses: [] })) };
+    const { vars, maps } = cycScope([shape], undefined, [...[...f.params, ...f.inputs, ...st, ...st.map(x => `l_${x}`), ...st.map(x => `r_${x}`), 'n$', 'N$'].map(v),
+        ...Object.values(f.leaf), ...Object.values(f.node), ...['Kind', 'Left', 'Right', ...st, ...f.inputs].map((x) => ({ op: 'get', map: `${x}@`, key: v('n$') }))]);
+    const t = leanTerms(vars, maps, id);
+    return `${cycFoldLean(id, f, [], vars, maps, t)}
+def ${id}_facts : List Fact := ${list(facts.map(g => `⟨${list(g.keys.map(k2 => String(vars.indexOf(k2))))}, ${t.c(g.holds)}⟩`))}
+${laws.map((l, j) => `-- CHECK ${id} fold law ${j}: ${l.name}
+example : foldOk ${id}_fold ${id}_fenc ${id}_facts (${t.c(l.holds)}) ⟨${list(nodes[j].hyps.map(t.c))}, ${t.c(nodes[j].concl)}, [], [], [], ([], .leaf [] [] [] [])⟩ = true := by ${checkBy}`).join('\n')}`;
+}
+// Bridge.lean's cyc_fold_sound for each law of a cyclic proof made by foldNodes: the fold as Kernel.lean's Fold, the
+// table (its added variables and maps), each law's check and its theorem over trees, as fold_sound states the usual one.
+function cycFoldLean(id, f, laws, vars, maps, t) {
+    const ix = (name) => { const j = vars.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no variable for ${name}`); return j; };
+    const mx = (name) => { const j = maps.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no map for ${name}`); return j; };
+    const st = Object.keys(f.leaf);
+    return `def ${id}_fold : Fold := ⟨${list(f.inputs.map(name => String(ix(name))))},
+  ${list(st.map(n2 => `(${ix(n2)}, ${ix(`l_${n2}`)}, ${ix(`r_${n2}`)})`))},
+  ${list(Object.entries(f.leaf).map(([name, e2]) => `(${ix(name)}, ${t.e(e2)})`))},
+  ${list(Object.entries(f.node).map(([name, e2]) => `(${ix(name)}, ${t.e(e2)})`))},
+  ${f.pre ? t.c(f.pre) : TRUE},
+  ${f.assume ? t.c(f.assume) : TRUE}⟩
+def ${id}_fenc : FoldEnc := ⟨${ix('n$')}, ${ix('N$')}, ${mx('Kind@')}, ${mx('Left@')}, ${mx('Right@')}, ${list([...st, ...f.inputs].map(x => `(${ix(x)}, ${mx(`${x}@`)})`))}⟩
+${laws.map((l, j) => `-- ${l.name}
+def ${id}_law${j} : C := ${t.c(l.holds)}
+theorem ${id}_law${j}_ok : foldOk ${id}_fold ${id}_fenc ${id}_facts ${id}_law${j} ${id}_node${j} = true := by ${checkBy}
+theorem ${id}_law${j}_holds : ∀ (maps : Nat → Nat → Nat) ρ, evalC ρ maps ${id}_fold.pre = true → ∀ t, Allowed ${id}_fold ρ maps t →
+    evalC (foldT ${id}_fold ρ maps t) maps ${id}_law${j} = true :=
+  cyc_fold_sound ${id}_fold ${id}_fenc ${id}_facts ${id}_nodes ${id}_check ${id}_law${j} ${id}_node${j} ${id}_node${j}_mem ${id}_law${j}_ok`).join('\n')}`;
+}
+// Bridge.lean's cyc_recur_sound for a cyclic proof made by recurNodes: the recurrence's equations checked against the
+// proof's facts, the nodes of its values (recF), its Lean definition (as recurToLean writes it) shown to be those values,
+// and each lemma and law between two points plainly of the definition.
+function cycRecurLean(id, p, r, vars, maps, t) {
+    const ix = (name) => { const j = vars.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no variable for ${name}`); return j; };
+    const mx = (name) => { const j = maps.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no map for ${name}`); return j; };
+    const fn = `${id}_fn`, args = r.args.map(recurArg), binders = args.map(a => `(${a} : Nat)`).join(' ');
+    const call = (x) => `(${[fn, ...args, x].join(' ')})`;
+    const surface = (names) => leanSurface({ ...Object.fromEntries(r.args.map((a, i) => [a, args[i]])), ...names }, id);
+    const renc = `⟨${mx(`${r.name}$`)}, ${ix('x')}, ${ix('prev')}, ${ix('k$')}⟩`;
+    const recF = `recF ${id}_zero ${id}_next ${ix('x')} ${ix('prev')}`;
+    const envAt = (pts) => `(fun i => ${[...pts, ...r.args.map((a, i) => [a, args[i]])].map(([v, val]) => `if i = ${ix(v)} then ${val} else `).join('')}0)`;
+    const node = (j) => `${id}_node${j}`;
+    const n = r.lemmas.length;
+    return `def ${id}_renc : RecEnc := ${renc}
+def ${id}_zero : E := ${t.e(r.zero)}
+def ${id}_next : E := ${t.e(r.next)}
+theorem ${id}_rok : recOk ${id}_renc ${id}_zero ${id}_next [] ${id}_facts = true := by ${checkBy}
+theorem ${id}_values : ∀ maps env, ∀ n ∈ ${id}_nodes, (∀ c ∈ n.hyps, evalC env (withMap maps ${mx(`${r.name}$`)} (${recF} env maps)) c = true) →
+    evalC env (withMap maps ${mx(`${r.name}$`)} (${recF} env maps)) n.concl = true :=
+  fun maps env => cyc_recur_sound ${id}_renc ${id}_zero ${id}_next [] ${id}_facts ${id}_nodes ${id}_check ${id}_rok maps env (by intro f hf; simp at hf)
+-- ${r.name} as Lean defines it (recurToLean's recursion), and the same as the values the proof is about.
+def ${fn} ${binders} : Nat → Nat
+  | 0 => ${surface({}).e(r.zero)}
+  | x + 1 => ${surface({ x: 'x', prev: call('x') }).e(r.next)}
+theorem ${fn}_eq (maps : Nat → Nat → Nat) (env : Nat → Nat) : ∀ n, ${recF} env maps n = ${[fn, ...r.args.map(a => `(env ${ix(a)})`)].join(' ')} n := by
+  intro n
+  induction n with
+  | zero => simp [recF, ${id}_zero, ${fn}, evalE]
+  | succ n ih => simp only [recF]; rw [ih]; simp [${id}_next, ${fn}, evalE, upd]
+${r.lemmas.map((l, j) => `/-- ${r.name}: ${l.name} -/
+theorem ${id}_lemma${j} ${binders} (x : Nat) : ${surface({ x: 'x', fx: call('x') }).c(l.holds)} := by
+  have h := ${id}_values (fun _ _ => 0) ${envAt([['x', 'x']])} _ ${node(j)}_mem (by rw [${node(j)}_hyps]; simp [${id}_hyps${j}])
+  rw [${node(j)}_concl] at h
+  simpa [${id}_concl${j}, evalC, evalE, withMap, ${fn}_eq] using h`).join('\n')}
+${r.between.map((b, j) => `/-- ${r.name}: ${b.name}, for every x ≤ y -/
+theorem ${id}_between${j} ${binders} (x y : Nat) (hxy : x ≤ y) : ${surface({ x: 'x', fx: call('x'), y: 'y', fy: call('y') }).c(b.holds)} := by
+  have h := ${id}_values (fun _ _ => 0) ${envAt([['x', 'x'], ['y', 'y']])} _ ${node(n + j)}_mem (by rw [${node(n + j)}_hyps]; simp [${id}_hyps${n + j}])
+  rw [${node(n + j)}_concl] at h
+  simp [${id}_concl${n + j}, evalC, evalE, withMap, ${fn}_eq] at h
+  first | exact h hxy | omega | exact h.resolve_left (by omega)`).join('\n')}`;
+}
+// Bridge.lean's cyc_machine_sound for each law of a cyclic proof made by machineNodes: the machine as Sets.lean's
+// SMachine, the encoding (its added variables and maps over time), each law's check and theorem, and the laws plainly.
+function cycBridgeLean(id, p, b, vars, maps, t) {
+    const ix = (name) => { const j = vars.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no variable for ${name}`); return j; };
+    const mx = (name) => { const j = maps.indexOf(name); if (j < 0)
+        throw new Error(`${id}: no map for ${name}`); return j; };
+    if (b.laws.length > p.nodes.length)
+        throw new Error(`${id}: more laws than nodes`);
+    const keysOf = (l) => [...(l.forall ? [l.forall] : []), ...(l.keys ?? [])];
+    const enc = (m) => `⟨${['u$', 'k$', 'T$', 'O$', 't$'].map(ix).join(', ')},
+  ${list([...Object.keys(m.state), ...m.inputs].map(x => `(${ix(x)}, ${mx(`${x}@`)})`))},
+  ${list([...Object.keys(m.maps ?? {}), ...(m.inputMaps ?? [])].map(x => `(${mx(x)}, ${mx(`${x}@`)})`))}⟩`;
+    const keysL = (l) => list(keysOf(l).map(k2 => String(ix(k2))));
+    return `def ${id}_machine : SMachine := ${machineLit(b.machine, t, ix, mx)}
+def ${id}_enc : CycEnc := ${enc(b.machine)}
+${b.laws.map((l, j) => `-- ${l.name}
+def ${id}_law${j} : C := ${t.c(l.holds)}
+def ${id}_l${j} : MLaw := ⟨${id}_law${j}, ${l.forall ? `some ${ix(l.forall)}` : 'none'}⟩
+theorem ${id}_law${j}_ok : cycMOk ${id}_machine ${id}_enc ${id}_facts ${id}_law${j} ${keysL(l)} ${id}_node${j} = true := by ${checkBy}
+theorem ${id}_law${j}_holds : ∀ ρ M, SReach ${id}_machine ρ M → ∀ ρ' : Nat → Nat, (∀ i, i ∉ ${keysL(l)} → ρ' i = ρ i) → evalC ρ' M ${id}_law${j} = true :=
+  cyc_machine_sound ${id}_machine ${id}_enc ${id}_facts ${id}_nodes ${id}_check ${id}_law${j} ${keysL(l)} ${id}_node${j} ${id}_node${j}_mem ${id}_law${j}_ok`).join('\n')}
+${(b.tampered ?? []).map((tm, j) => `-- TAMPERED: ${tm.what}. Lean computes the check against the proof to false.
+def ${id}_tamperedm${j} : SMachine := ${machineLit(tm.machine, t, ix, mx)}
+example : cycMOk ${id}_tamperedm${j} ${id}_enc ${id}_facts ${id}_law0 ${keysL(b.laws[0])} ${id}_node0 = false := by ${checkBy}`).join('\n')}
+${readable(id, b.laws, vars, maps, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat)', hyp: `SReach ${id}_machine ρ μ`, call: '',
+        have: j => `have hl : holdsOver ${id}_l${j} μ ${list((b.laws[j].keys ?? []).map(k2 => String(ix(k2))))} ρ := cyc_machine_holds (${id}_law${j}_holds ρ μ h)` })}`;
+}