gdp-wired 0.4.0 → 0.5.0

package/dist/kernel/kernel.js

@@ -35,11 +35,24 @@ function decide(lin, path) {
     const flipped = path.get(canon(add(k(1), scale(lin, -1))))?.holds;
     return flipped === undefined ? undefined : !flipped;
 }
-// A term's linear form under the path, or undefined if the path leaves one of its choices open.
-// Reads become cells, named by map and key: `M[key]`.
+// A term's linear form under the path. Reads become cells, named by map and key: `M[key]`; a choice the path leaves
+// open (∸, min, max, if) becomes a column of its own, `⟦n⟧`, standing for the term's value (see termRows).
+// Remembered per path and term (a path is never changed once built; a new decision is a new path), so a term shared
+// across hypotheses, or nested in a k-step run's later states, is read once per path.
+const linearMemo = new WeakMap();
 export function linear(e, path) {
+    let memo = linearMemo.get(path);
+    if (!memo)
+        linearMemo.set(path, (memo = new WeakMap()));
+    if (memo.has(e))
+        return memo.get(e);
+    const out = linearOf(e, path);
+    memo.set(e, out);
+    return out;
+}
+function linearOf(e, path) {
     switch (e.op) {
-        case 'var': return e.name === '1' || /[*[\],:]/.test(e.name) ? undefined : v(e.name); // those characters build cells and monomials
+        case 'var': return e.name === '1' || /[*[\],:⟦]/.test(e.name) ? undefined : v(e.name); // those characters build cells, monomials and term columns
         case 'const': return k(e.value);
         case 'mul': {
             const a = linear(e.a, path);
@@ -61,14 +74,14 @@ export function linear(e, path) {
                 return undefined;
             const aLeB = decide(sub(a, b), path), bLeA = decide(sub(b, a), path);
             if (e.op === 'sub')
-                return bLeA === true ? sub(a, b) : bLeA === false ? k(0) : undefined;
+                return bLeA === true ? sub(a, b) : bLeA === false ? k(0) : v(termColumn(e));
             if (aLeB === undefined)
-                return undefined;
+                return v(termColumn(e));
             return (e.op === 'min') === aLeB ? a : b;
         }
         case 'if': {
             const c = truth(e.c, path);
-            return c === undefined ? undefined : linear(c ? e.then : e.else, path);
+            return c === undefined ? v(termColumn(e)) : linear(c ? e.then : e.else, path);
         }
         case 'get': {
             const key = linear(e.key, path);
@@ -76,6 +89,61 @@ export function linear(e, path) {
         }
     }
 }
+// --- term columns -------------------------------------------------------------------------------------------------------
+// A choice the path leaves open is a column ⟦n⟧ for the n-th term met (one table per process: the name only has to be
+// the same for the same term). A leaf reads it through rows that hold whichever way the choice goes (termRows), so a
+// fact about the choice's value can be split on, and proven, before the choice is decided.
+// Terms are hash-consed: a term's id comes from its operator, its fields and its parts' ids, remembered per object, so a
+// deep term (a k-step run nests k steps) is read once, not once per lookup.
+const termIds = new Map(), termTable = [], memo = new WeakMap();
+function termId(t) {
+    const had = memo.get(t);
+    if (had !== undefined)
+        return had;
+    const parts = Object.entries(t).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0)).map(([key, val]) => (Array.isArray(val) ? `${key}=[${val.map(x => termId(x)).join(',')}]` : typeof val === 'object' && val !== null ? `${key}=#${termId(val)}` : `${key}=${JSON.stringify(val)}`));
+    const key = parts.join(';');
+    let id = termIds.get(key);
+    if (id === undefined) {
+        id = termTable.length;
+        termIds.set(key, id);
+        termTable.push(t);
+    }
+    memo.set(t, id);
+    return id;
+}
+export const termColumn = (e) => `⟦${termId(e)}⟧`;
+export const columnTerm = (name) => { const m = /^⟦(\d+)⟧$/.exec(name); return m ? termTable[Number(m[1])] : undefined; };
+// Whether the path decides a choice's top (an if's condition, which side of min, max or ∸).
+export function decided(e, path) {
+    if (e.op === 'if')
+        return truth(e.c, path) !== undefined;
+    if (e.op !== 'sub' && e.op !== 'min' && e.op !== 'max')
+        return true;
+    const a = linear(e.a, path), b = linear(e.b, path);
+    return !!a && !!b && decide(e.op === 'sub' ? sub(b, a) : sub(a, b), path) !== undefined;
+}
+// The rows a term column brings: its bounds, true whichever way the choice goes (min(a, b) ≤ a and ≤ b; max(a, b) ≥ a
+// and ≥ b; a ∸ b ≥ a − b and ≤ a), and, once the path decides it, its equality to the branch taken.
+export function termRows(name, path) {
+    const e = columnTerm(name), col = v(name), out = [];
+    if (e.op === 'min' || e.op === 'max' || e.op === 'sub') {
+        const a = linear(e.a, path), b = linear(e.b, path);
+        if (a && b) {
+            if (e.op === 'min')
+                out.push(sub(col, a), sub(col, b));
+            if (e.op === 'max')
+                out.push(sub(a, col), sub(b, col));
+            if (e.op === 'sub')
+                out.push(sub(sub(a, b), col), sub(col, a));
+        }
+    }
+    if (decided(e, path)) {
+        const r = linear(e, path);
+        if (r)
+            out.push(sub(col, r), sub(r, col));
+    }
+    return out;
+}
 // Products: multiply out, each monomial (variables joined by '*', sorted) one more natural variable. Forgetting how
 // monomials relate (x*x to x, say) only weakens what a leaf may use, so it stays sound; distributing is what proves
 // spend <= m·count over a node from the same law at its children. Map reads can't be factors.
@@ -83,8 +151,8 @@ function times(a, b) {
     const out = [];
     for (const [p, cp] of Object.entries(a))
         for (const [q, cq] of Object.entries(b)) {
-            if (p.includes('[') || q.includes('['))
-                return undefined;
+            if (p.includes('[') || q.includes('[') || p.includes('⟦') || q.includes('⟦'))
+                return undefined; // factors are variables (and monomials of them)
             const factors = [...(p === '1' ? [] : p.split('*')), ...(q === '1' ? [] : q.split('*'))].sort();
             out.push({ [factors.length ? factors.join('*') : '1']: cp * cq });
         }
@@ -172,6 +240,23 @@ export function leafConstraints(goal, path) {
             if (decide(d, path) === true && decide(scale(d, -1), path) === true)
                 rows.push({ lin: sub(v(p.name), v(q.name)), label: '' }, { lin: sub(v(q.name), v(p.name)), label: '' });
         }
+    // Each term column's rows, and the columns those rows bring in turn.
+    const seen = new Set(), todo = [...names].filter(n => n.startsWith('⟦'));
+    while (todo.length) {
+        const name = todo.pop();
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        for (const lin of termRows(name, path)) {
+            rows.push({ lin, label: '' });
+            for (const key of Object.keys(lin))
+                if (key !== '1') {
+                    names.add(key);
+                    if (key.startsWith('⟦') && !seen.has(key))
+                        todo.push(key);
+                }
+        }
+    }
     for (const name of names)
         rows.push({ lin: { [name]: -1 }, label: '' });
     return rows;
@@ -300,6 +385,14 @@ const step = (r, u) => {
             flags: at.flags,
         } };
 };
+// The state after a step, named: each state variable a fresh name n~j equal to its term there, which later frames read,
+// so a run of k steps is k small frames rather than a term nesting each state in the next (which grows as 3^k when a
+// step reads its state thrice). The names are new to the goal; each equation holds of the run that took the steps.
+const nameState = (r, state, j) => ({
+    hyps: [...r.hyps, ...state.map(n => ({ op: '=', a: { op: 'var', name: stateName(n, j) }, b: r.at.vars[n] ?? { op: 'var', name: n } }))],
+    at: { ...r.at, vars: { ...r.at.vars, ...Object.fromEntries(state.map(n => [n, { op: 'var', name: stateName(n, j) }])) } },
+});
+export const stateName = (n, j) => `${n}~${j}`;
 // The conclusion read at the run's end: plain names at the last frame.
 const atEnd = (r, c) => substC(c, r.at);
 // The conclusion read across the run: plain names at the first frame, primed names (s', and M'[k] as a read of the map
@@ -799,8 +892,9 @@ export function stepLawObligations(machine, laws, instances, sl) {
     const primes = [...state, ...maps].map(n => `${n}'`);
     const laters = Array.from({ length: k - 1 }, (_, i) => laterNames(m, i + 2));
     const later = laters.flatMap(l => Object.values(l.vars).map(e => e.name)), laterMaps = laters.flatMap(l => Object.values(l.maps));
+    const names = Array.from({ length: k - 1 }, (_, i) => state.map(n => stateName(n, i + 1))).flat();
     const taken = [...m.params, ...m.inputs, ...state, ...maps, ...carried];
-    for (const p of [...primes, ...later, ...laterMaps])
+    for (const p of [...primes, ...later, ...laterMaps, ...names])
         if (taken.includes(p))
             throw new Error(`${m.name}: ${p} is a name of the machine and a name a step law reads`);
     for (const key of [sl.forall, ...(sl.keys ?? [])])
@@ -822,14 +916,30 @@ export function stepLawObligations(machine, laws, instances, sl) {
         if (j > 1)
             run = reading(run, laters[j - 2].vars, laters[j - 2].maps);
         run = step(holds(run, [...assumed(laws, instances), ...assume, ...(whens[j - 1] ? [inlineFlags(m, whens[j - 1])] : []), ...closing(m, instances)]), u);
+        if (j < k)
+            run = nameState(run, state, j);
     }
     return [goal(k === 1 ? `${sl.name} @step law` : `${sl.name} @${k} steps`, run, across(run, sl.then, state, maps, { inputs: {}, flags: flagsOf(m) }))];
 }
 // The laws' proof and every step law's tree: all must check.
 // `perStep`: a step law's own instances, where it has them (else `instances`).
+// Each frame's hypotheses read no name a later step's request is read by: the condition the Lean twin's proof needs
+// (Sets.lean's checkSKStep, `avoids (szone s sl)`; plain flags are inlined here, so their names never occur), checked
+// here alike.
 export function checkStepLaws(m, laws, stepLaws, proof) {
-    return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => stepLawObligations(m, laws, proof.perStep?.[sl.name] ?? proof.instances, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name])));
+    return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => {
+        const inst = proof.perStep?.[sl.name] ?? proof.instances, plain = m.history ? historyMachine(m).machine : m;
+        const zone = stepZone(plain, sl.steps ?? 1);
+        return [...assumed(laws, inst), ...assumed(plain.facts ?? [], inst), ...closing(plain, inst)].every(c => !mentions(c, zone))
+            && stepLawObligations(m, laws, inst, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name]));
+    });
 }
+// The names a k-step law's run introduces past its first frame: each later step's inputs, quantified flags and their
+// witnesses, and the state after each step but the last (stateName).
+export const stepZone = (m, k) => [
+    ...Array.from({ length: k - 1 }, (_, i) => Object.values(laterNames(m, i + 2).vars).map(e => e.name)).flat(),
+    ...Array.from({ length: k - 1 }, (_, i) => Object.keys(m.state).map(n => stateName(n, i + 1))).flat(),
+];
 export function foldObligations(f, laws) {
     if (![...Object.values(f.leaf), ...Object.values(f.node)].every(natural) || !laws.every(law => !law.forall && !law.keys?.length && naturalC(law.holds) && !mentions(law.holds, f.inputs)))
         throw new Error('outside the kernel');

package/dist/kernel/prove.js

@@ -1,5 +1,5 @@
-import { add, k, scale, solve, sub } from "../core/solver.js";
-import { assumed, canon, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
+import { add, k, scale, solve, sub, v } from "../core/solver.js";
+import { assumed, canon, columnTerm, decided, stepZone, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
 // The atoms the path leaves open, in evaluation order: deciding any of them makes progress.
 function openE(e, path, out) {
     switch (e.op) {
@@ -22,7 +22,7 @@ function openE(e, path, out) {
         case 'max': {
             openE(e.a, path, out), openE(e.b, path, out);
             const a = linear(e.a, path), b = linear(e.b, path);
-            if (a && b && linear(e, path) === undefined)
+            if (a && b && !decided(e, path))
                 out.push(e.op === 'sub' ? sub(b, a) : sub(a, b));
             return;
         }
@@ -116,12 +116,34 @@ function parse(text) {
 // The budget: 200,000 nodes and, by default, a second per hypothesis (at least 20 seconds) per goal; past either the goal
 // is left `unknown`. A goal with many instances (a law about two keys at its pairs) has that many more rows per leaf.
 export function grow(goal, path = new Map(), budget = { nodes: 0, until: performance.now() + Math.max(20_000, 1_000 * goal.hyps.length) }) {
+    // At the root: plainly first; where the cases multiply past a budget, through cuts. The plain budget halves with each
+    // two open choices (what a plain search's cases grow by), so a long run's steps reach the cuts early.
+    if (path.size === 0 && budget.nodes === 0) {
+        const open = new Set(leafConstraints(goal, path).flatMap(r => Object.keys(r.lin)).filter(n => n.startsWith('⟦') && columnTerm(n)?.op === 'if')).size;
+        const plain = growPlain(goal, path, { nodes: 0, until: budget.until, cap: Math.max(32, Math.round(4_000 / 2 ** (open / 2))) });
+        if ('tree' in plain || plain.stuck === 'sat' || plain.why === undefined)
+            return plain;
+        const cut = withCuts(goal, path, budget);
+        if (cut)
+            return cut;
+    }
+    return growPlain(goal, path, budget);
+}
+function growPlain(goal, path, budget) {
+    if (budget.cap !== undefined && budget.nodes >= budget.cap)
+        return { stuck: 'unknown', path, why: 'cap' };
     if (++budget.nodes > 200_000 || (budget.until !== undefined && performance.now() > budget.until))
         return { stuck: 'unknown', path, why: outOfBudget(goal, budget.nodes > 200_000 ? 'nodes' : 'time', path.size) };
-    const rows = leafConstraints(goal, path);
+    // Rows that read a term column only once a cut has put one on the path; before, the rows a choice-free search uses
+    // (what it saw before term columns), renumbered to the whole leaf's when a leaf is found.
+    const full = leafConstraints(goal, path);
+    const columns = [...path.values()].some(a => Object.keys(a.lin).some(key => key.startsWith('⟦')));
+    const idx = full.flatMap((r, i) => (columns || !Object.keys(r.lin).some(key => key.startsWith('⟦')) ? [i] : []));
+    const rows = idx.map(i => full[i]), at = (i) => (i < rows.length ? idx[i] : full.length + i - rows.length);
+    const leafOf = (steps, products) => ({ leaf: steps.map(st => (st.kind === 'input' ? { ...st, index: at(st.index) } : st)), ...(products ? { products: products.map(([i, j]) => [at(i), at(j)]) } : {}) });
     const verdict = solve(rows);
     if (verdict.kind === 'refuted')
-        return { tree: { leaf: verdict.steps }, nodes: budget.nodes };
+        return { tree: leafOf(verdict.steps), nodes: budget.nodes };
     const open = [];
     for (const h of goal.hyps)
         openH(h, path, open);
@@ -148,7 +170,7 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
         pairs.splice(300);
         const product = solve(withProducts(rows, pairs));
         if (product.kind === 'refuted')
-            return { tree: { leaf: product.steps, products: pairs }, nodes: budget.nodes };
+            return { tree: leafOf(product.steps, pairs), nodes: budget.nodes };
         // Degree three: each row times each product of two variables (x·y >= 0 is the pair of -x <= 0 and -y <= 0).
         const degree = Math.max(...rows.flatMap(r => Object.keys(r.lin).map(key => (key === '1' ? 0 : key.split('*').length))));
         if (degree >= 3) {
@@ -159,7 +181,7 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
                     cubes.push([rows.length + s, i]);
             const third = solve(withProducts(rows, [...sq, ...cubes]));
             if (third.kind === 'refuted')
-                return { tree: { leaf: third.steps, products: [...sq, ...cubes] }, nodes: budget.nodes };
+                return { tree: leafOf(third.steps, [...sq, ...cubes]), nodes: budget.nodes };
         }
         const factors = [...new Set(rows.flatMap(r => Object.keys(r.lin).filter(key => key.includes('*')).flatMap(key => key.split('*'))))];
         const fresh = (lin) => !path.has(canon(lin)) && !path.has(canon(add(k(1), scale(lin, -1))));
@@ -174,10 +196,10 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
     if (!split)
         return { stuck: verdict.kind === 'sat' ? 'sat' : 'unknown', ...(verdict.kind === 'sat' ? { witness: verdict.witness } : {}), path };
     const id = canon(split);
-    const yes = grow(goal, new Map(path).set(id, { lin: split, holds: true }), budget);
+    const yes = growPlain(goal, new Map(path).set(id, { lin: split, holds: true }), budget);
     if (!('tree' in yes))
         return yes;
-    const no = grow(goal, new Map(path).set(id, { lin: split, holds: false }), budget);
+    const no = growPlain(goal, new Map(path).set(id, { lin: split, holds: false }), budget);
     if (!('tree' in no))
         return no;
     return { tree: { split, yes: yes.tree, no: no.tree }, nodes: budget.nodes };
@@ -189,6 +211,90 @@ function outOfBudget(goal, limit, depth) {
         `Each case a step decides multiplies the cases to refute, so ${steps > 1 ? `a law over ${steps} steps` : 'many interacting cases'} can outgrow it: ` +
         'state the law over fewer steps (a one-step law and an invariant often give the same), or split it into laws about fewer conditions';
 }
+// Cuts: where each of many choices (a step's case, over a run of k steps) multiplies the cases, a fact about each
+// choice's value that holds whichever way it goes is split on first: its failing side is refuted by deciding that
+// choice alone, and the rest of the proof assumes it, so the tree is a chain of small refutations instead of every
+// combination. For a term column t = if c then A else B the candidates are t ≤ A, t ≤ B, t ≥ A and t ≥ B, innermost
+// choices first; a cut is only a split, so the kernel checks it like any other.
+function withCuts(goal, path, budget) {
+    const rows = leafConstraints(goal, path);
+    const columns = [...new Set(rows.flatMap(r => Object.keys(r.lin)).filter(n => n.startsWith('⟦')))]
+        .map(n => ({ n, e: columnTerm(n) })).filter(x => x.e.op === 'if' && !decided(x.e, path))
+        .sort((a, b) => Number(a.n.slice(1, -1)) - Number(b.n.slice(1, -1))); // a term's parts get their ids before it: innermost first
+    const chain = [];
+    let at = new Map(path);
+    for (const { n, e } of columns) {
+        if (e.op !== 'if')
+            continue;
+        const a = linear(e.then, at), b = linear(e.else, at), focus = topAtoms(e.c, at);
+        if (!a || !b || !focus.length)
+            continue;
+        for (const lemma of [sub(v(n), a), sub(v(n), b), sub(a, v(n)), sub(b, v(n))]) {
+            const id = canon(lemma);
+            if (at.has(id) || Object.keys(lemma).every(key => key === '1'))
+                continue;
+            const no = growFocused(goal, new Map(at).set(id, { lin: lemma, holds: false }), focus, { nodes: 0 });
+            if ('tree' in no) {
+                chain.push({ split: lemma, no: no.tree });
+                at = new Map(at).set(id, { lin: lemma, holds: true });
+            }
+        }
+    }
+    if (!chain.length)
+        return undefined;
+    const rest = growPlain(goal, at, budget);
+    if (!('tree' in rest))
+        return rest;
+    return { tree: chain.reduceRight((acc, c) => ({ split: c.split, yes: acc, no: c.no }), rest.tree), nodes: budget.nodes };
+}
+// A condition's own comparisons, each a split atom, read with term columns for whatever choices are inside it.
+function topAtoms(c, path) {
+    if (c.op === 'not')
+        return topAtoms(c.x, path);
+    if (c.op === 'and' || c.op === 'or')
+        return c.xs.flatMap(y => topAtoms(y, path));
+    if (c.op === 'flag' || c.op === 'all')
+        return [];
+    const a = linear(c.a, path), b = linear(c.b, path);
+    if (!a || !b)
+        return [];
+    const atoms = c.op === '<=' ? [sub(a, b)] : c.op === '<' ? [add(sub(a, b), k(1))] : [sub(a, b), sub(b, a)];
+    return atoms.filter(l => Object.keys(l).some(key => key !== '1') && !path.has(canon(l)) && !path.has(canon(add(k(1), scale(l, -1)))));
+}
+// A refutation that splits only on these atoms (a cut's failing side), within a small budget.
+function growFocused(goal, path, focus, budget, near = focus) {
+    if (++budget.nodes > 64)
+        return { stuck: 'unknown', path };
+    const verdict = solveNear(leafConstraints(goal, path), [...near, ...[...path.values()].slice(-1).map(a => a.lin)]);
+    if (verdict.kind === 'refuted')
+        return { tree: { leaf: verdict.steps }, nodes: budget.nodes };
+    const split = focus.find(l => !path.has(canon(l)) && !path.has(canon(add(k(1), scale(l, -1)))));
+    if (!split)
+        return { stuck: verdict.kind === 'sat' ? 'sat' : 'unknown', path };
+    const id = canon(split);
+    const yes = growFocused(goal, new Map(path).set(id, { lin: split, holds: true }), focus, budget, near);
+    if (!('tree' in yes))
+        return yes;
+    const no = growFocused(goal, new Map(path).set(id, { lin: split, holds: false }), focus, budget, near);
+    if (!('tree' in no))
+        return no;
+    return { tree: { split, yes: yes.tree, no: no.tree }, nodes: budget.nodes };
+}
+// A refutation from the rows near some facts (the rows reachable from their variables in two hops, each row joining the
+// variables it reads), its inputs renumbered to the whole leaf's. A cut about one step of a long run needs that step's
+// rows, not the run's; a cut it misses is only a cut not made (the plain search still follows).
+function solveNear(rows, seeds) {
+    const reach = new Set(seeds.flatMap(l => Object.keys(l).filter(key => key !== '1')));
+    for (let hop = 0; hop < 2; hop++)
+        for (const r of rows) {
+            const keys = Object.keys(r.lin).filter(key => key !== '1');
+            if (keys.some(key => reach.has(key)))
+                keys.forEach(key => reach.add(key));
+        }
+    const picked = rows.flatMap((r, i) => (Object.keys(r.lin).every(key => key === '1' || reach.has(key)) ? [i] : []));
+    const near = solve(picked.map(i => rows[i]));
+    return near.kind === 'refuted' ? { kind: 'refuted', steps: near.steps.map(st => (st.kind === 'input' ? { ...st, index: picked[st.index] } : st)) } : near;
+}
 // Integer completeness for bounded systems: when elimination is inexact and finds no witness, halve a variable's range
 // (x <= mid or x >= mid + 1). Each half is a split like any other, so the kernel checks it the same way; a variable
 // pinned to one value becomes an equality, which the solver substitutes exactly.
@@ -370,6 +476,42 @@ function match(pattern, term, x) {
 const witnesses = (m) => Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [{ op: 'var', name: `w?${f}` }] : []));
 // The keys each quantified flag is assumed at (instances under ?f).
 const flagInstances = (m, keys) => Object.fromEntries(Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [[`?${f}`, keys]] : [])));
+// The instances some goals need, for every entry point: the every-key laws and the quantified flags at `seed` (the keys
+// the step and the laws read, when known before any goal is built), then twice round: the facts at every key the goals
+// built so far read a function at, and, where the seed doesn't cover them (no seed, positions that shift, a law about
+// several keys), the every-key laws and flags at every key they read a map at (a law about several keys at tuples
+// relating `focus`, the goals' own keys).
+function instancesFor(m, laws, build, opts = {}) {
+    let inst = opts.start ?? (opts.seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : opts.seed])), ...flagInstances(m, opts.seed) } : {});
+    const reads = opts.reads ?? (!opts.seed || shifts(m) || laws.some(l => l.keys?.length));
+    for (let round = 0; round < 2; round++) {
+        if (m.facts?.length)
+            inst = withFacts(m, inst, fnKeys(m, build(inst)));
+        if (reads) {
+            const keys = mapKeys(build(inst));
+            inst = union(withReads(laws, inst, keys, opts.focus ?? []), flagInstances(m, keys));
+        }
+    }
+    return inst;
+}
+// Instances without the keys that read any of these names (a law about several keys loses each tuple that does).
+const avoiding = (inst, names, laws) => {
+    const bad = (e) => names.some(n => JSON.stringify(e).includes(`"name":${JSON.stringify(n)}`));
+    return Object.fromEntries(Object.entries(inst).map(([n, keys]) => {
+        const arity = (laws.find(l => l.name === n)?.keys?.length ?? 0) + 1;
+        const tuples = Array.from({ length: Math.floor(keys.length / arity) }, (_, t) => keys.slice(t * arity, (t + 1) * arity));
+        return [n, tuples.filter(tuple => !tuple.some(bad)).flat()];
+    }));
+};
+// Two sets of instances together: each name at the keys of both.
+const union = (a, b) => {
+    const out = { ...a };
+    for (const [n, keys] of Object.entries(b)) {
+        const seen = new Set((out[n] ?? []).map(e => JSON.stringify(e)));
+        out[n] = [...(out[n] ?? []), ...keys.filter(e => !seen.has(JSON.stringify(e)))];
+    }
+    return out;
+};
 const someKeys = (c, positive = true) => c.op === 'all' ? [...(positive ? [] : [c]), ...someKeys(c.c, positive)] : c.op === 'not' ? someKeys(c.x, !positive) : c.op === 'and' || c.op === 'or' ? c.xs.flatMap(y => someKeys(y, positive)) : [];
 function atWitness(c, picks, positive = true) {
     switch (c.op) {
@@ -434,23 +576,14 @@ export function proveLaws(m, laws) {
     return { ...proveLawsAsGiven(m, out.items), laws: out.items };
 }
 function proveLawsAsGiven(m, laws) {
-    const keys = [...readKeys(m, laws), ...witnesses(m)];
-    const instances = {};
-    for (const law of laws) {
-        const at = [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : []), ...(law.keys ?? []).map((name) => ({ op: 'var', name }))];
-        instances[law.name] = { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : at])), ...flagInstances(m, at) };
-    }
-    // The facts about functions, at every key each law's goals read a function at (found from the goals, twice round).
-    for (let round = 0; round < 2 && m.facts?.length; round++) {
-        const goals = obligations(m, laws, instances);
-        laws.forEach((law, i) => { instances[law.name] = withFacts(m, instances[law.name], fnKeys(m, goals.slice(2 * i, 2 * i + 2))); });
-    }
-    // Where positions shift (a write at every key reading its key at k ∸ 1 or k + 1) or a law is about two keys, the
-    // every-key laws also at each key the goals read a map at, once round.
-    if (shifts(m) || laws.some(l => l.keys?.length)) {
-        const goals = obligations(m, laws, instances);
-        laws.forEach((law, i) => { instances[law.name] = withReads(laws, instances[law.name], mapKeys(goals.slice(2 * i, 2 * i + 2)), [...(law.forall ? [`${law.forall}#`] : []), ...(law.keys ?? [])]); });
-    }
+    // Each law's two goals (start and step) get their own instances, seeded with its own keys.
+    const keys = [...readKeys(m, laws), ...witnesses(m)], instances = {};
+    laws.forEach((law, i) => {
+        instances[law.name] = instancesFor(m, laws, inst => obligations(m, laws, { ...instances, [law.name]: inst }).slice(2 * i, 2 * i + 2), {
+            seed: [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : []), ...(law.keys ?? []).map((name) => ({ op: 'var', name }))],
+            focus: [...(law.forall ? [`${law.forall}#`] : []), ...(law.keys ?? [])],
+        });
+    });
     const trees = {};
     let nodes = 0, leaves = 0;
     for (const goal of obligations(m, laws, instances)) {
@@ -483,16 +616,19 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     if (!base.proof)
         return { proven: false, nodes: base.nodes, leaves: base.leaves, checked: false };
     const plain = m.history ? historyMachine(m).machine : m;
-    const keys = [...readKeys(plain, laws), ...witnesses(plain), ...stepLaws.flatMap(sl => [sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC)),
-        ...stepLaws.flatMap(sl => [sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : [])))];
-    let instances = { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : keys])), ...flagInstances(plain, keys) };
-    for (let round = 0; round < 2 && plain.facts?.length; round++)
-        instances = withFacts(plain, instances, fnKeys(plain, stepLaws.flatMap(sl => stepLawObligations(m, laws, instances, sl))));
-    // Where positions shift or a law is about two keys, each step law gets its own instances, from its own goal.
+    // Each step law its own instances, from its own goal: the keys the step and the laws read, and its own (a k-step
+    // law's later frames read keys no other step law has); where positions shift or a law is about several keys, the
+    // keys its goal reads a map at too. A frame's hypotheses read no name the run introduces later (kernel.ts's
+    // stepZone), so a k-step law drops the keys that read one.
+    const shared = [...readKeys(plain, laws), ...witnesses(plain)], named = [...laws, ...(plain.facts ?? [])], reads = shifts(plain) || laws.some(l => l.keys?.length);
+    const own = (sl) => [...[sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC),
+        ...[sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : []))];
     const perStep = {};
-    if (shifts(plain) || laws.some(l => l.keys?.length))
-        for (const sl of stepLaws)
-            perStep[sl.name] = withReads(laws, instances, mapKeys(stepLawObligations(m, laws, instances, sl)), [sl.forall, ...(sl.keys ?? [])].flatMap(k => (k ? [k] : [])));
+    for (const sl of stepLaws) {
+        const zone = stepZone(plain, sl.steps ?? 1), keep = (inst) => avoiding(inst, zone, named);
+        perStep[sl.name] = keep(instancesFor(plain, laws, inst => stepLawObligations(m, laws, keep(inst), sl), { seed: [...shared, ...own(sl)], focus: [sl.forall, ...(sl.keys ?? [])].flatMap(k => (k ? [k] : [])), reads }));
+    }
+    const instances = perStep[stepLaws[0]?.name ?? ''] ?? {};
     const trees = {};
     let nodes = base.nodes, leaves = base.leaves;
     for (const sl of stepLaws)
@@ -514,10 +650,7 @@ export function proveProgress(m, laws, p) {
     if (!base.proven || !base.checked)
         return { proven: false, nodes: base.nodes, leaves: base.leaves, ...(base.failed ? { failed: base.failed } : {}), checked: false };
     const ls = base.laws ?? laws;
-    let instances = { ...withReads(ls, {}, mapKeys(progressObligations(m, ls, {}, p)), []), ...flagInstances(m, mapKeys(progressObligations(m, ls, {}, p))) };
-    instances = { ...instances, ...withReads(ls, instances, mapKeys(progressObligations(m, ls, instances, p)), []) };
-    if (m.facts?.length)
-        instances = withFacts(m, instances, fnKeys(m, progressObligations(m, ls, instances, p)));
+    const instances = instancesFor(m, ls, inst => progressObligations(m, ls, inst, p));
     const trees = {};
     let nodes = base.nodes, leaves = base.leaves;
     for (const goal of progressObligations(m, ls, instances, p)) {
@@ -614,21 +747,12 @@ export function concretize(goal, bound = 12) {
 // The facts a goal needs, as hypotheses: each fact about every key at the keys the goal reads a function at (and at
 // the keys those facts read, a second round), each plain fact as it is.
 export function factsFor(m, goal) {
-    let instances = {};
-    for (let round = 0; round < 2; round++)
-        instances = withFacts(m, instances, fnKeys(m, [{ ...goal, hyps: [...assumed(m.facts ?? [], instances), ...goal.hyps] }]));
-    return assumed(m.facts ?? [], instances);
+    return assumed(m.facts ?? [], instancesFor(m, [], inst => [{ ...goal, hyps: [...assumed(m.facts ?? [], inst), ...goal.hyps] }]));
 }
 // A goal built from its instances (an exporter's goal, shaped as its Lean twin builds it): the every-key laws, the
 // quantified flags and the facts assumed at every key it reads a map or function at, then a tree, checked.
 export function proveBuilt(m, laws, build) {
-    let instances = {};
-    for (let round = 0; round < 2; round++) {
-        const g = build(instances), keys = mapKeys([g]);
-        instances = { ...withReads(laws, instances, keys, []), ...flagInstances(m, keys) };
-        if (m.facts?.length)
-            instances = withFacts(m, instances, fnKeys(m, [build(instances)]));
-    }
+    const instances = instancesFor(m, laws, inst => [build(inst)]);
     const goal = build(instances), out = grow(goal);
     if (!('tree' in out) || !check(goal, out.tree))
         return { proven: false };

package/dist/lean-kernel/emit.js

@@ -1,6 +1,6 @@
 import { atMost, n, not, pointWrite } from "../core/machine.js";
 import { add, k, scale, sub } from "../core/solver.js";
-import { canon, historyMachine, foldObligations, leafConstraints, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, withProducts } from "../kernel/kernel.js";
+import { canon, columnTerm, stateName, termColumn, historyMachine, foldObligations, leafConstraints, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, withProducts } from "../kernel/kernel.js";
 import { grow, proveBuilt, proveLaws, proveStepLaws } from "../kernel/prove.js";
 import { refinement, refinementSides } from "../core/compose.js";
 import { leanTerms } from "./lean-terms.js";
@@ -52,11 +52,13 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
     // Columns: every variable of the hypotheses, then every cell any leaf uses (and the cells inside their keys),
     // shallower cells first so a key reads only earlier columns.
     const vars = globalVars ?? [...new Set(goal.hyps.flatMap(varsOf))];
-    const cells = new Set();
+    const cells = new Set(), terms = new Set();
     const addCell = (name) => { if (cells.has(name))
         return; cells.add(name); for (const key of Object.keys(cellKey(name)))
         if (key.includes('['))
-            addCell(key); };
+            addCell(key);
+        else if (key.startsWith('⟦'))
+            terms.add(key); };
     // Monomials: every one a leaf's rows or products use, or that a product term has under the leaf's path.
     const monos = new Set();
     const subterms = (c) => {
@@ -77,11 +79,29 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
         wc(c);
         return out2;
     };
+    // Every choice in the hypotheses has its column, whether or not a leaf's rows keep it (a column can cancel, T − T,
+    // yet Lean's linear form of T still needs it): each distinct subterm once, as a run's states are shared.
+    const seenTerms = new WeakSet();
+    const choices = (t) => {
+        if (seenTerms.has(t))
+            return;
+        seenTerms.add(t);
+        if (t.op === 'sub' || t.op === 'min' || t.op === 'max' || t.op === 'if')
+            terms.add(termColumn(t));
+        for (const val of Object.values(t))
+            if (Array.isArray(val))
+                val.forEach(x => choices(x));
+            else if (typeof val === 'object' && val !== null)
+                choices(val);
+    };
+    goal.hyps.forEach(choices);
     leaves(tree, new Map(), (leaf, path) => {
         for (const r of withProducts(leafConstraints(goal, path), leaf.products ?? []))
             for (const key of Object.keys(r.lin)) {
                 if (key.includes('['))
                     addCell(key);
+                else if (key.startsWith('⟦'))
+                    terms.add(key);
                 else if (key.includes('*'))
                     monos.add(key);
             }
@@ -93,7 +113,8 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
                             monos.add(key);
     });
     const depth = (name) => name.split('[').length;
-    const cols = [...vars, ...[...monos].sort((a, b) => a.split('*').length - b.split('*').length), ...[...cells].sort((a, b) => depth(a) - depth(b))];
+    // Term columns (open choices, each standing for its term's value) before the cells, whose keys may read them.
+    const cols = [...vars, ...[...monos].sort((a, b) => a.split('*').length - b.split('*').length), ...[...terms].sort((a, b) => Number(a.slice(1, -1)) - Number(b.slice(1, -1))), ...[...cells].sort((a, b) => depth(a) - depth(b))];
     const col = new Map(cols.map((name, j) => [name, j]));
     const maps = globalMaps ?? [...new Set([...[...cells].map(cellMap), ...goal.hyps.flatMap(h => [...JSON.stringify(h).matchAll(/"op":"get","map":"([^"]+)"/g)].map(m => m[1]))])];
     const dense = (lin) => {
@@ -110,11 +131,12 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
         return coefs;
     };
     const row = (lin) => `⟨${list(dense(lin).map(int))}, ${int(lin['1'] ?? 0)}⟩`;
-    const tab = cols.map(name => (name.includes('[') ? `.cell ${maps.indexOf(cellMap(name))} ${row(cellKey(name))}`
-        : name.includes('*') ? `.mono ${list(name.split('*').map(f => { const j = vars.indexOf(f); if (j < 0)
-            throw new Error(`${ex.name}: factor ${f}`); return j; }).sort((a, b) => a - b).map(String))}`
-            : `.var ${vars.indexOf(name)}`));
     const { e, c } = leanTerms(vars, maps, ex.name);
+    const tab = cols.map(name => (name.includes('[') ? `.cell ${maps.indexOf(cellMap(name))} ${row(cellKey(name))}`
+        : name.startsWith('⟦') ? `.term (${e(columnTerm(name))})`
+            : name.includes('*') ? `.mono ${list(name.split('*').map(f => { const j = vars.indexOf(f); if (j < 0)
+                throw new Error(`${ex.name}: factor ${f}`); return j; }).sort((a, b) => a - b).map(String))}`
+                : `.var ${vars.indexOf(name)}`));
     let leafNo = 0;
     const lean = (t, path) => {
         if (!('leaf' in t)) {
@@ -504,7 +526,8 @@ def ${id}_step${j} : SKStep := ⟨⟨${list(Array.from({ length: kk }, (_, s2) =
   ${list(qinsts(inst))},
   ${list(finsts(inst))},
   ${list(pinsts(inst))},
-  []⟩
+  [],
+  ${list(Array.from({ length: kk - 1 }, (_, s2) => list(Object.keys(m.state).map(n2 => `(${ix(n2)}, ${ix(stateName(n2, s2 + 1))})`))))}⟩
 theorem ${id}_step${j}_holds : SKStepHolds ${id}_machine ${id}_step${j} :=
   skstep_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by decide +kernel)`;
             } }));
@@ -625,7 +648,8 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
     const allowGoals = [...allowed.values()].flatMap(a => (a ? [a.out.goal] : []));
     const vars = [...new Set([...m.params, ...m.inputs, ...Object.keys(m.state), ...keysOf, ...keysOf.map(k2 => `${k2}#`), '#', ...flags.map(([f]) => `?${f}`),
             ...quantified.map(f => `w?${f}`), ...boundKeys(m), ...(opts.tamper ? boundKeys(opts.tamper.machine) : []), ...stepLaws.flatMap(sl => (sl.forall ? [sl.forall] : [])), ...(opts.free ?? []),
-            ...primes, ...later, ...[...goalsL, ...goalsS, ...allowGoals].flatMap(g => g.hyps.flatMap(varsOf))])];
+            ...primes, ...later, ...Array.from({ length: k - 1 }, (_, j) => Object.keys(m.state).map(n2 => stateName(n2, j + 1))).flat(),
+            ...[...goalsL, ...goalsS, ...allowGoals].flatMap(g => g.hyps.flatMap(varsOf))])];
     const baseMaps = [...new Set([...Object.keys(m.maps ?? {}), ...Object.keys(m.step.maps ?? {}), ...Object.keys(m.fns ?? {})])];
     const mapNames = [...new Set([...baseMaps, ...carried, ...(allSteps.length ? Object.keys(m.maps ?? {}).map(mp => `${mp}'`) : []), ...laterMaps,
             ...[...JSON.stringify([...goalsL, ...goalsS, ...allowGoals]).matchAll(/"op":"get","map":"([^"]+)"/g)].map(x2 => x2[1])])];