gdp-wired 0.4.0 → 0.6.0

package/dist/kernel/kernel.js

@@ -35,11 +35,24 @@ function decide(lin, path) {
     const flipped = path.get(canon(add(k(1), scale(lin, -1))))?.holds;
     return flipped === undefined ? undefined : !flipped;
 }
-// A term's linear form under the path, or undefined if the path leaves one of its choices open.
-// Reads become cells, named by map and key: `M[key]`.
+// A term's linear form under the path. Reads become cells, named by map and key: `M[key]`; a choice the path leaves
+// open (∸, min, max, if) becomes a column of its own, `⟦n⟧`, standing for the term's value (see termRows).
+// Remembered per path and term (a path is never changed once built; a new decision is a new path), so a term shared
+// across hypotheses, or nested in a k-step run's later states, is read once per path.
+const linearMemo = new WeakMap();
 export function linear(e, path) {
+    let memo = linearMemo.get(path);
+    if (!memo)
+        linearMemo.set(path, (memo = new WeakMap()));
+    if (memo.has(e))
+        return memo.get(e);
+    const out = linearOf(e, path);
+    memo.set(e, out);
+    return out;
+}
+function linearOf(e, path) {
     switch (e.op) {
-        case 'var': return e.name === '1' || /[*[\],:]/.test(e.name) ? undefined : v(e.name); // those characters build cells and monomials
+        case 'var': return e.name === '1' || /[*[\],:⟦]/.test(e.name) ? undefined : v(e.name); // those characters build cells, monomials and term columns
         case 'const': return k(e.value);
         case 'mul': {
             const a = linear(e.a, path);
@@ -61,14 +74,14 @@ export function linear(e, path) {
                 return undefined;
             const aLeB = decide(sub(a, b), path), bLeA = decide(sub(b, a), path);
             if (e.op === 'sub')
-                return bLeA === true ? sub(a, b) : bLeA === false ? k(0) : undefined;
+                return bLeA === true ? sub(a, b) : bLeA === false ? k(0) : v(termColumn(e));
             if (aLeB === undefined)
-                return undefined;
+                return v(termColumn(e));
             return (e.op === 'min') === aLeB ? a : b;
         }
         case 'if': {
             const c = truth(e.c, path);
-            return c === undefined ? undefined : linear(c ? e.then : e.else, path);
+            return c === undefined ? v(termColumn(e)) : linear(c ? e.then : e.else, path);
         }
         case 'get': {
             const key = linear(e.key, path);
@@ -76,6 +89,61 @@ export function linear(e, path) {
         }
     }
 }
+// --- term columns -------------------------------------------------------------------------------------------------------
+// A choice the path leaves open is a column ⟦n⟧ for the n-th term met (one table per process: the name only has to be
+// the same for the same term). A leaf reads it through rows that hold whichever way the choice goes (termRows), so a
+// fact about the choice's value can be split on, and proven, before the choice is decided.
+// Terms are hash-consed: a term's id comes from its operator, its fields and its parts' ids, remembered per object, so a
+// deep term (a k-step run nests k steps) is read once, not once per lookup.
+const termIds = new Map(), termTable = [], memo = new WeakMap();
+function termId(t) {
+    const had = memo.get(t);
+    if (had !== undefined)
+        return had;
+    const parts = Object.entries(t).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0)).map(([key, val]) => (Array.isArray(val) ? `${key}=[${val.map(x => termId(x)).join(',')}]` : typeof val === 'object' && val !== null ? `${key}=#${termId(val)}` : `${key}=${JSON.stringify(val)}`));
+    const key = parts.join(';');
+    let id = termIds.get(key);
+    if (id === undefined) {
+        id = termTable.length;
+        termIds.set(key, id);
+        termTable.push(t);
+    }
+    memo.set(t, id);
+    return id;
+}
+export const termColumn = (e) => `⟦${termId(e)}⟧`;
+export const columnTerm = (name) => { const m = /^⟦(\d+)⟧$/.exec(name); return m ? termTable[Number(m[1])] : undefined; };
+// Whether the path decides a choice's top (an if's condition, which side of min, max or ∸).
+export function decided(e, path) {
+    if (e.op === 'if')
+        return truth(e.c, path) !== undefined;
+    if (e.op !== 'sub' && e.op !== 'min' && e.op !== 'max')
+        return true;
+    const a = linear(e.a, path), b = linear(e.b, path);
+    return !!a && !!b && decide(e.op === 'sub' ? sub(b, a) : sub(a, b), path) !== undefined;
+}
+// The rows a term column brings: its bounds, true whichever way the choice goes (min(a, b) ≤ a and ≤ b; max(a, b) ≥ a
+// and ≥ b; a ∸ b ≥ a − b and ≤ a), and, once the path decides it, its equality to the branch taken.
+export function termRows(name, path) {
+    const e = columnTerm(name), col = v(name), out = [];
+    if (e.op === 'min' || e.op === 'max' || e.op === 'sub') {
+        const a = linear(e.a, path), b = linear(e.b, path);
+        if (a && b) {
+            if (e.op === 'min')
+                out.push(sub(col, a), sub(col, b));
+            if (e.op === 'max')
+                out.push(sub(a, col), sub(b, col));
+            if (e.op === 'sub')
+                out.push(sub(sub(a, b), col), sub(col, a));
+        }
+    }
+    if (decided(e, path)) {
+        const r = linear(e, path);
+        if (r)
+            out.push(sub(col, r), sub(r, col));
+    }
+    return out;
+}
 // Products: multiply out, each monomial (variables joined by '*', sorted) one more natural variable. Forgetting how
 // monomials relate (x*x to x, say) only weakens what a leaf may use, so it stays sound; distributing is what proves
 // spend <= m·count over a node from the same law at its children. Map reads can't be factors.
@@ -83,8 +151,8 @@ function times(a, b) {
     const out = [];
     for (const [p, cp] of Object.entries(a))
         for (const [q, cq] of Object.entries(b)) {
-            if (p.includes('[') || q.includes('['))
-                return undefined;
+            if (p.includes('[') || q.includes('[') || p.includes('⟦') || q.includes('⟦'))
+                return undefined; // factors are variables (and monomials of them)
             const factors = [...(p === '1' ? [] : p.split('*')), ...(q === '1' ? [] : q.split('*'))].sort();
             out.push({ [factors.length ? factors.join('*') : '1']: cp * cq });
         }
@@ -172,6 +240,23 @@ export function leafConstraints(goal, path) {
             if (decide(d, path) === true && decide(scale(d, -1), path) === true)
                 rows.push({ lin: sub(v(p.name), v(q.name)), label: '' }, { lin: sub(v(q.name), v(p.name)), label: '' });
         }
+    // Each term column's rows, and the columns those rows bring in turn.
+    const seen = new Set(), todo = [...names].filter(n => n.startsWith('⟦'));
+    while (todo.length) {
+        const name = todo.pop();
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        for (const lin of termRows(name, path)) {
+            rows.push({ lin, label: '' });
+            for (const key of Object.keys(lin))
+                if (key !== '1') {
+                    names.add(key);
+                    if (key.startsWith('⟦') && !seen.has(key))
+                        todo.push(key);
+                }
+        }
+    }
     for (const name of names)
         rows.push({ lin: { [name]: -1 }, label: '' });
     return rows;
@@ -300,6 +385,14 @@ const step = (r, u) => {
             flags: at.flags,
         } };
 };
+// The state after a step, named: each state variable a fresh name n~j equal to its term there, which later frames read,
+// so a run of k steps is k small frames rather than a term nesting each state in the next (which grows as 3^k when a
+// step reads its state thrice). The names are new to the goal; each equation holds of the run that took the steps.
+const nameState = (r, state, j) => ({
+    hyps: [...r.hyps, ...state.map(n => ({ op: '=', a: { op: 'var', name: stateName(n, j) }, b: r.at.vars[n] ?? { op: 'var', name: n } }))],
+    at: { ...r.at, vars: { ...r.at.vars, ...Object.fromEntries(state.map(n => [n, { op: 'var', name: stateName(n, j) }])) } },
+});
+export const stateName = (n, j) => `${n}~${j}`;
 // The conclusion read at the run's end: plain names at the last frame.
 const atEnd = (r, c) => substC(c, r.at);
 // The conclusion read across the run: plain names at the first frame, primed names (s', and M'[k] as a read of the map
@@ -623,8 +716,6 @@ export function historyMachine(m) {
     const h = m.history;
     if (!h)
         return { machine: m, goals: [] };
-    if (m.inputMaps?.length || quantified(m).length || Object.values(m.step.maps ?? {}).some(w => 'each' in w))
-        throw new Error(`${m.name}: a machine with a history has no maps carried by requests, quantified flags or writes at every key`);
     const queries = Object.keys(h.queries), sums = Object.keys(h.sums), plainInputs = m.inputs.filter(i => !queries.includes(i));
     const fields = h.record.map(f => `r.${f}`);
     const taken = [...m.params, ...m.inputs, ...Object.keys(m.state), ...Object.keys(m.step.state ?? {})];
@@ -641,12 +732,15 @@ export function historyMachine(m) {
     if (h.prune && !(h.record.includes(h.prune.order) && natural(h.prune.after) && readsOnly(h.prune.after, m.params)))
         throw new Error('a history is pruned by a recorded input and a term over the params');
     const atRequest = { vars: Object.fromEntries(h.record.map(f => [`r.${f}`, { op: 'var', name: f }])), maps: {}, flags: {} };
-    const relations = (h.relations ?? []).map(r => ({ op: 'or', xs: [{ op: 'not', x: r.when }, r.holds] }));
+    // The relations conjoined to the assumption as the Lean twin builds them (History.lean's HMachine.plain: assume ∧
+    // r₁ ∧ … ∧ true), so the two read the same assumption.
+    const TRUE = { op: '<=', a: { op: 'const', value: 0 }, b: { op: 'const', value: 0 } };
+    const relations = (h.relations ?? []).map(r => ({ op: 'or', xs: [{ op: 'not', x: r.when }, r.holds] })).reduceRight((acc, r) => ({ op: 'and', xs: [r, acc] }), TRUE);
     const machine = {
         ...m, history: undefined,
         state: { ...m.state, ...Object.fromEntries(sums.map(s => [s, { op: 'const', value: 0 }])) },
         step: { ...m.step, state: { ...m.step.state, ...Object.fromEntries(sums.map(s => [s, { op: 'add', a: { op: 'var', name: s }, b: { op: 'if', c: h.keep, then: substE(h.sums[s], atRequest), else: { op: 'const', value: 0 } } }])) } },
-        ...(m.assume || relations.length ? { assume: { op: 'and', xs: [...(m.assume ? [m.assume] : []), ...relations] } } : {}),
+        assume: { op: 'and', xs: [m.assume ?? TRUE, relations] },
     };
     const perRecord = { vars: { ...h.sums, ...h.queries }, maps: {}, flags: {} };
     const goals = (h.relations ?? []).map((r, i) => ({ name: `relation ${i + 1} @record`, hyps: [...preOf(m), r.when, { op: 'not', x: substC(r.holds, perRecord) }] }));
@@ -688,10 +782,20 @@ export function obligations(m, laws, instances = {}) {
 export function checkLaws(m, laws, proof) {
     return obligations(m, laws, proof.instances).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name]));
 }
+// A loop is a machine: its state, a turn's inputs as a request, its body taken where `while` holds and the state kept
+// where it fails. Its invariants are the machine's laws, and that it halts is a liveness: from anywhere, `while` fails
+// later, every request helpful, the rank the loop's (Live.lean's Loop.machine and loop_halts_of: then no run of turns is
+// infinite). `while` and the rank read the state and params, not the turn's input.
 // A rank may be a tuple, compared in order (lexicographically): the first part drops, or it stays and the rest drops.
 // Tuples of naturals can't drop forever either; nested loops need them (an outer count, then an inner one).
 // A rank reads the state and params only: one that reads the turn's input drops against this turn's input, but the next
 // turn measures it with a fresh one, so nothing need decrease (while x < w, x := x + 1, rank w ∸ x, w = x + 1 each turn).
+export const loopMachine = (l) => ({
+    name: l.name, params: l.params, inputs: l.inputs, state: l.state,
+    step: { state: Object.fromEntries(Object.entries(l.body).map(([v, e]) => [v, { op: 'if', c: l.while, then: e, else: { op: 'var', name: v } }])) },
+    ...(l.pre ? { pre: l.pre } : {}), ...(l.assume ? { assume: l.assume } : {}),
+});
+export const loopLiveness = (l, rank) => ({ name: `${l.name} halts`, from: trueC, to: { op: 'not', x: l.while }, rank, request: {} });
 export function loopObligations(l, laws, rank) {
     const ranks = Array.isArray(rank) ? rank : [rank];
     const parts = [...Object.values(l.state), ...Object.values(l.body), ...ranks];
@@ -701,26 +805,17 @@ export function loopObligations(l, laws, rank) {
         if (!(name in l.state))
             throw new Error(`${l.name}'s body sets ${name}, which isn't in its state`);
     inScope(`${l.name}'s start`, Object.values(l.state), l.params);
-    inScope(l.name, [...Object.values(l.body), l.while, ...(l.assume ? [l.assume] : [])], names);
+    inScope(l.name, [...Object.values(l.body), ...(l.assume ? [l.assume] : [])], names);
+    inScope(`${l.name}'s while`, [l.while], [...l.params, ...Object.keys(l.state)]);
     inScope(`${l.name}'s precondition`, l.pre ? [l.pre] : [], l.params);
     inScope(`${l.name}'s rank and laws`, [...ranks, ...laws.map(law => law.holds)], [...l.params, ...Object.keys(l.state)]);
     if (ranks.some(r => mentions({ op: '=', a: r, b: r }, l.inputs)))
         throw new Error('a rank reads the state and params, not the turn\'s input');
     if (!parts.every(natural) || !naturalC(l.while) || !laws.every(law => !law.forall && !law.keys?.length && naturalC(law.holds) && !mentions(law.holds, l.inputs)))
         throw new Error('outside the kernel');
-    const pre = preOf(l);
-    const start = holds(from({ vars: { ...l.state }, maps: {}, flags: {} }), pre);
-    const turn = step(holds(from(), [...pre, ...(l.assume ? [l.assume] : []), l.while, ...laws.map(law => law.holds)]), { vars: l.body, maps: {} });
-    return [
-        ...laws.flatMap(law => [goal(`${law.name} @start`, start, atEnd(start, law.holds)), goal(`${law.name} @turn`, turn, atEnd(turn, law.holds))]),
-        goal('rank drops', turn, drops(ranks, turn.at)),
-    ];
+    const m = loopMachine(l), { stay, cover, helps } = livenessParts(m, loopLiveness(l, rank));
+    return [...obligations(m, laws, {}), ...[stay, cover, ...helps].map(sl => stepLawObligations(m, laws, {}, sl)[0])];
 }
-const drops = (ranks, turn) => {
-    const [r, ...rest] = ranks;
-    const after = substE(r, turn), less = { op: '<', a: after, b: r };
-    return rest.length === 0 ? less : { op: 'or', xs: [less, { op: 'and', xs: [{ op: '=', a: after, b: r }, drops(rest, turn)] }] };
-};
 // --- progress: laws with "there is a request" ----------------------------------------------------------------------
 // "In every reachable state where `when` holds, some request makes `then` true of the step": proven by naming the
 // request (a term per input over the state and params) and proving it allowed (the machine's assumption holds of it)
@@ -799,8 +894,9 @@ export function stepLawObligations(machine, laws, instances, sl) {
     const primes = [...state, ...maps].map(n => `${n}'`);
     const laters = Array.from({ length: k - 1 }, (_, i) => laterNames(m, i + 2));
     const later = laters.flatMap(l => Object.values(l.vars).map(e => e.name)), laterMaps = laters.flatMap(l => Object.values(l.maps));
+    const names = Array.from({ length: k - 1 }, (_, i) => state.map(n => stateName(n, i + 1))).flat();
     const taken = [...m.params, ...m.inputs, ...state, ...maps, ...carried];
-    for (const p of [...primes, ...later, ...laterMaps])
+    for (const p of [...primes, ...later, ...laterMaps, ...names])
         if (taken.includes(p))
             throw new Error(`${m.name}: ${p} is a name of the machine and a name a step law reads`);
     for (const key of [sl.forall, ...(sl.keys ?? [])])
@@ -822,14 +918,30 @@ export function stepLawObligations(machine, laws, instances, sl) {
         if (j > 1)
             run = reading(run, laters[j - 2].vars, laters[j - 2].maps);
         run = step(holds(run, [...assumed(laws, instances), ...assume, ...(whens[j - 1] ? [inlineFlags(m, whens[j - 1])] : []), ...closing(m, instances)]), u);
+        if (j < k)
+            run = nameState(run, state, j);
     }
     return [goal(k === 1 ? `${sl.name} @step law` : `${sl.name} @${k} steps`, run, across(run, sl.then, state, maps, { inputs: {}, flags: flagsOf(m) }))];
 }
 // The laws' proof and every step law's tree: all must check.
 // `perStep`: a step law's own instances, where it has them (else `instances`).
+// Each frame's hypotheses read no name a later step's request is read by: the condition the Lean twin's proof needs
+// (Sets.lean's checkSKStep, `avoids (szone s sl)`; plain flags are inlined here, so their names never occur), checked
+// here alike.
 export function checkStepLaws(m, laws, stepLaws, proof) {
-    return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => stepLawObligations(m, laws, proof.perStep?.[sl.name] ?? proof.instances, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name])));
+    return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => {
+        const inst = proof.perStep?.[sl.name] ?? proof.instances, plain = m.history ? historyMachine(m).machine : m;
+        const zone = stepZone(plain, sl.steps ?? 1);
+        return [...assumed(laws, inst), ...assumed(plain.facts ?? [], inst), ...closing(plain, inst)].every(c => !mentions(c, zone))
+            && stepLawObligations(m, laws, inst, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name]));
+    });
 }
+// The names a k-step law's run introduces past its first frame: each later step's inputs, quantified flags and their
+// witnesses, and the state after each step but the last (stateName).
+export const stepZone = (m, k) => [
+    ...Array.from({ length: k - 1 }, (_, i) => Object.values(laterNames(m, i + 2).vars).map(e => e.name)).flat(),
+    ...Array.from({ length: k - 1 }, (_, i) => Object.keys(m.state).map(n => stateName(n, i + 1))).flat(),
+];
 export function foldObligations(f, laws) {
     if (![...Object.values(f.leaf), ...Object.values(f.node)].every(natural) || !laws.every(law => !law.forall && !law.keys?.length && naturalC(law.holds) && !mentions(law.holds, f.inputs)))
         throw new Error('outside the kernel');

package/dist/kernel/prove.js

@@ -1,5 +1,5 @@
-import { add, k, scale, solve, sub } from "../core/solver.js";
-import { assumed, canon, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
+import { add, k, scale, solve, sub, v } from "../core/solver.js";
+import { assumed, canon, columnTerm, decided, stepZone, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
 // The atoms the path leaves open, in evaluation order: deciding any of them makes progress.
 function openE(e, path, out) {
     switch (e.op) {
@@ -22,7 +22,7 @@ function openE(e, path, out) {
         case 'max': {
             openE(e.a, path, out), openE(e.b, path, out);
             const a = linear(e.a, path), b = linear(e.b, path);
-            if (a && b && linear(e, path) === undefined)
+            if (a && b && !decided(e, path))
                 out.push(e.op === 'sub' ? sub(b, a) : sub(a, b));
             return;
         }
@@ -116,12 +116,34 @@ function parse(text) {
 // The budget: 200,000 nodes and, by default, a second per hypothesis (at least 20 seconds) per goal; past either the goal
 // is left `unknown`. A goal with many instances (a law about two keys at its pairs) has that many more rows per leaf.
 export function grow(goal, path = new Map(), budget = { nodes: 0, until: performance.now() + Math.max(20_000, 1_000 * goal.hyps.length) }) {
+    // At the root: plainly first; where the cases multiply past a budget, through cuts. The plain budget halves with each
+    // two open choices (what a plain search's cases grow by), so a long run's steps reach the cuts early.
+    if (path.size === 0 && budget.nodes === 0) {
+        const open = new Set(leafConstraints(goal, path).flatMap(r => Object.keys(r.lin)).filter(n => n.startsWith('⟦') && columnTerm(n)?.op === 'if')).size;
+        const plain = growPlain(goal, path, { nodes: 0, until: budget.until, cap: Math.max(32, Math.round(4_000 / 2 ** (open / 2))) });
+        if ('tree' in plain || plain.stuck === 'sat' || plain.why === undefined)
+            return plain;
+        const cut = withCuts(goal, path, budget);
+        if (cut)
+            return cut;
+    }
+    return growPlain(goal, path, budget);
+}
+function growPlain(goal, path, budget) {
+    if (budget.cap !== undefined && budget.nodes >= budget.cap)
+        return { stuck: 'unknown', path, why: 'cap' };
     if (++budget.nodes > 200_000 || (budget.until !== undefined && performance.now() > budget.until))
         return { stuck: 'unknown', path, why: outOfBudget(goal, budget.nodes > 200_000 ? 'nodes' : 'time', path.size) };
-    const rows = leafConstraints(goal, path);
+    // Rows that read a term column only once a cut has put one on the path; before, the rows a choice-free search uses
+    // (what it saw before term columns), renumbered to the whole leaf's when a leaf is found.
+    const full = leafConstraints(goal, path);
+    const columns = [...path.values()].some(a => Object.keys(a.lin).some(key => key.startsWith('⟦')));
+    const idx = full.flatMap((r, i) => (columns || !Object.keys(r.lin).some(key => key.startsWith('⟦')) ? [i] : []));
+    const rows = idx.map(i => full[i]), at = (i) => (i < rows.length ? idx[i] : full.length + i - rows.length);
+    const leafOf = (steps, products) => ({ leaf: steps.map(st => (st.kind === 'input' ? { ...st, index: at(st.index) } : st)), ...(products ? { products: products.map(([i, j]) => [at(i), at(j)]) } : {}) });
     const verdict = solve(rows);
     if (verdict.kind === 'refuted')
-        return { tree: { leaf: verdict.steps }, nodes: budget.nodes };
+        return { tree: leafOf(verdict.steps), nodes: budget.nodes };
     const open = [];
     for (const h of goal.hyps)
         openH(h, path, open);
@@ -148,7 +170,7 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
         pairs.splice(300);
         const product = solve(withProducts(rows, pairs));
         if (product.kind === 'refuted')
-            return { tree: { leaf: product.steps, products: pairs }, nodes: budget.nodes };
+            return { tree: leafOf(product.steps, pairs), nodes: budget.nodes };
         // Degree three: each row times each product of two variables (x·y >= 0 is the pair of -x <= 0 and -y <= 0).
         const degree = Math.max(...rows.flatMap(r => Object.keys(r.lin).map(key => (key === '1' ? 0 : key.split('*').length))));
         if (degree >= 3) {
@@ -159,7 +181,7 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
                     cubes.push([rows.length + s, i]);
             const third = solve(withProducts(rows, [...sq, ...cubes]));
             if (third.kind === 'refuted')
-                return { tree: { leaf: third.steps, products: [...sq, ...cubes] }, nodes: budget.nodes };
+                return { tree: leafOf(third.steps, [...sq, ...cubes]), nodes: budget.nodes };
         }
         const factors = [...new Set(rows.flatMap(r => Object.keys(r.lin).filter(key => key.includes('*')).flatMap(key => key.split('*'))))];
         const fresh = (lin) => !path.has(canon(lin)) && !path.has(canon(add(k(1), scale(lin, -1))));
@@ -174,10 +196,10 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
     if (!split)
         return { stuck: verdict.kind === 'sat' ? 'sat' : 'unknown', ...(verdict.kind === 'sat' ? { witness: verdict.witness } : {}), path };
     const id = canon(split);
-    const yes = grow(goal, new Map(path).set(id, { lin: split, holds: true }), budget);
+    const yes = growPlain(goal, new Map(path).set(id, { lin: split, holds: true }), budget);
     if (!('tree' in yes))
         return yes;
-    const no = grow(goal, new Map(path).set(id, { lin: split, holds: false }), budget);
+    const no = growPlain(goal, new Map(path).set(id, { lin: split, holds: false }), budget);
     if (!('tree' in no))
         return no;
     return { tree: { split, yes: yes.tree, no: no.tree }, nodes: budget.nodes };
@@ -189,6 +211,90 @@ function outOfBudget(goal, limit, depth) {
         `Each case a step decides multiplies the cases to refute, so ${steps > 1 ? `a law over ${steps} steps` : 'many interacting cases'} can outgrow it: ` +
         'state the law over fewer steps (a one-step law and an invariant often give the same), or split it into laws about fewer conditions';
 }
+// Cuts: where each of many choices (a step's case, over a run of k steps) multiplies the cases, a fact about each
+// choice's value that holds whichever way it goes is split on first: its failing side is refuted by deciding that
+// choice alone, and the rest of the proof assumes it, so the tree is a chain of small refutations instead of every
+// combination. For a term column t = if c then A else B the candidates are t ≤ A, t ≤ B, t ≥ A and t ≥ B, innermost
+// choices first; a cut is only a split, so the kernel checks it like any other.
+function withCuts(goal, path, budget) {
+    const rows = leafConstraints(goal, path);
+    const columns = [...new Set(rows.flatMap(r => Object.keys(r.lin)).filter(n => n.startsWith('⟦')))]
+        .map(n => ({ n, e: columnTerm(n) })).filter(x => x.e.op === 'if' && !decided(x.e, path))
+        .sort((a, b) => Number(a.n.slice(1, -1)) - Number(b.n.slice(1, -1))); // a term's parts get their ids before it: innermost first
+    const chain = [];
+    let at = new Map(path);
+    for (const { n, e } of columns) {
+        if (e.op !== 'if')
+            continue;
+        const a = linear(e.then, at), b = linear(e.else, at), focus = topAtoms(e.c, at);
+        if (!a || !b || !focus.length)
+            continue;
+        for (const lemma of [sub(v(n), a), sub(v(n), b), sub(a, v(n)), sub(b, v(n))]) {
+            const id = canon(lemma);
+            if (at.has(id) || Object.keys(lemma).every(key => key === '1'))
+                continue;
+            const no = growFocused(goal, new Map(at).set(id, { lin: lemma, holds: false }), focus, { nodes: 0 });
+            if ('tree' in no) {
+                chain.push({ split: lemma, no: no.tree });
+                at = new Map(at).set(id, { lin: lemma, holds: true });
+            }
+        }
+    }
+    if (!chain.length)
+        return undefined;
+    const rest = growPlain(goal, at, budget);
+    if (!('tree' in rest))
+        return rest;
+    return { tree: chain.reduceRight((acc, c) => ({ split: c.split, yes: acc, no: c.no }), rest.tree), nodes: budget.nodes };
+}
+// A condition's own comparisons, each a split atom, read with term columns for whatever choices are inside it.
+function topAtoms(c, path) {
+    if (c.op === 'not')
+        return topAtoms(c.x, path);
+    if (c.op === 'and' || c.op === 'or')
+        return c.xs.flatMap(y => topAtoms(y, path));
+    if (c.op === 'flag' || c.op === 'all')
+        return [];
+    const a = linear(c.a, path), b = linear(c.b, path);
+    if (!a || !b)
+        return [];
+    const atoms = c.op === '<=' ? [sub(a, b)] : c.op === '<' ? [add(sub(a, b), k(1))] : [sub(a, b), sub(b, a)];
+    return atoms.filter(l => Object.keys(l).some(key => key !== '1') && !path.has(canon(l)) && !path.has(canon(add(k(1), scale(l, -1)))));
+}
+// A refutation that splits only on these atoms (a cut's failing side), within a small budget.
+function growFocused(goal, path, focus, budget, near = focus) {
+    if (++budget.nodes > 64)
+        return { stuck: 'unknown', path };
+    const verdict = solveNear(leafConstraints(goal, path), [...near, ...[...path.values()].slice(-1).map(a => a.lin)]);
+    if (verdict.kind === 'refuted')
+        return { tree: { leaf: verdict.steps }, nodes: budget.nodes };
+    const split = focus.find(l => !path.has(canon(l)) && !path.has(canon(add(k(1), scale(l, -1)))));
+    if (!split)
+        return { stuck: verdict.kind === 'sat' ? 'sat' : 'unknown', path };
+    const id = canon(split);
+    const yes = growFocused(goal, new Map(path).set(id, { lin: split, holds: true }), focus, budget, near);
+    if (!('tree' in yes))
+        return yes;
+    const no = growFocused(goal, new Map(path).set(id, { lin: split, holds: false }), focus, budget, near);
+    if (!('tree' in no))
+        return no;
+    return { tree: { split, yes: yes.tree, no: no.tree }, nodes: budget.nodes };
+}
+// A refutation from the rows near some facts (the rows reachable from their variables in two hops, each row joining the
+// variables it reads), its inputs renumbered to the whole leaf's. A cut about one step of a long run needs that step's
+// rows, not the run's; a cut it misses is only a cut not made (the plain search still follows).
+function solveNear(rows, seeds) {
+    const reach = new Set(seeds.flatMap(l => Object.keys(l).filter(key => key !== '1')));
+    for (let hop = 0; hop < 2; hop++)
+        for (const r of rows) {
+            const keys = Object.keys(r.lin).filter(key => key !== '1');
+            if (keys.some(key => reach.has(key)))
+                keys.forEach(key => reach.add(key));
+        }
+    const picked = rows.flatMap((r, i) => (Object.keys(r.lin).every(key => key === '1' || reach.has(key)) ? [i] : []));
+    const near = solve(picked.map(i => rows[i]));
+    return near.kind === 'refuted' ? { kind: 'refuted', steps: near.steps.map(st => (st.kind === 'input' ? { ...st, index: picked[st.index] } : st)) } : near;
+}
 // Integer completeness for bounded systems: when elimination is inexact and finds no witness, halve a variable's range
 // (x <= mid or x >= mid + 1). Each half is a split like any other, so the kernel checks it the same way; a variable
 // pinned to one value becomes an equality, which the solver substitutes exactly.
@@ -370,6 +476,42 @@ function match(pattern, term, x) {
 const witnesses = (m) => Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [{ op: 'var', name: `w?${f}` }] : []));
 // The keys each quantified flag is assumed at (instances under ?f).
 const flagInstances = (m, keys) => Object.fromEntries(Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [[`?${f}`, keys]] : [])));
+// The instances some goals need, for every entry point: the every-key laws and the quantified flags at `seed` (the keys
+// the step and the laws read, when known before any goal is built), then twice round: the facts at every key the goals
+// built so far read a function at, and, where the seed doesn't cover them (no seed, positions that shift, a law about
+// several keys), the every-key laws and flags at every key they read a map at (a law about several keys at tuples
+// relating `focus`, the goals' own keys).
+function instancesFor(m, laws, build, opts = {}) {
+    let inst = opts.start ?? (opts.seed ? { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : opts.seed])), ...flagInstances(m, opts.seed) } : {});
+    const reads = opts.reads ?? (!opts.seed || shifts(m) || laws.some(l => l.keys?.length));
+    for (let round = 0; round < 2; round++) {
+        if (m.facts?.length)
+            inst = withFacts(m, inst, fnKeys(m, build(inst)));
+        if (reads) {
+            const keys = mapKeys(build(inst));
+            inst = union(withReads(laws, inst, keys, opts.focus ?? []), flagInstances(m, keys));
+        }
+    }
+    return inst;
+}
+// Instances without the keys that read any of these names (a law about several keys loses each tuple that does).
+const avoiding = (inst, names, laws) => {
+    const bad = (e) => names.some(n => JSON.stringify(e).includes(`"name":${JSON.stringify(n)}`));
+    return Object.fromEntries(Object.entries(inst).map(([n, keys]) => {
+        const arity = (laws.find(l => l.name === n)?.keys?.length ?? 0) + 1;
+        const tuples = Array.from({ length: Math.floor(keys.length / arity) }, (_, t) => keys.slice(t * arity, (t + 1) * arity));
+        return [n, tuples.filter(tuple => !tuple.some(bad)).flat()];
+    }));
+};
+// Two sets of instances together: each name at the keys of both.
+const union = (a, b) => {
+    const out = { ...a };
+    for (const [n, keys] of Object.entries(b)) {
+        const seen = new Set((out[n] ?? []).map(e => JSON.stringify(e)));
+        out[n] = [...(out[n] ?? []), ...keys.filter(e => !seen.has(JSON.stringify(e)))];
+    }
+    return out;
+};
 const someKeys = (c, positive = true) => c.op === 'all' ? [...(positive ? [] : [c]), ...someKeys(c.c, positive)] : c.op === 'not' ? someKeys(c.x, !positive) : c.op === 'and' || c.op === 'or' ? c.xs.flatMap(y => someKeys(y, positive)) : [];
 function atWitness(c, picks, positive = true) {
     switch (c.op) {
@@ -434,23 +576,14 @@ export function proveLaws(m, laws) {
     return { ...proveLawsAsGiven(m, out.items), laws: out.items };
 }
 function proveLawsAsGiven(m, laws) {
-    const keys = [...readKeys(m, laws), ...witnesses(m)];
-    const instances = {};
-    for (const law of laws) {
-        const at = [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : []), ...(law.keys ?? []).map((name) => ({ op: 'var', name }))];
-        instances[law.name] = { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : at])), ...flagInstances(m, at) };
-    }
-    // The facts about functions, at every key each law's goals read a function at (found from the goals, twice round).
-    for (let round = 0; round < 2 && m.facts?.length; round++) {
-        const goals = obligations(m, laws, instances);
-        laws.forEach((law, i) => { instances[law.name] = withFacts(m, instances[law.name], fnKeys(m, goals.slice(2 * i, 2 * i + 2))); });
-    }
-    // Where positions shift (a write at every key reading its key at k ∸ 1 or k + 1) or a law is about two keys, the
-    // every-key laws also at each key the goals read a map at, once round.
-    if (shifts(m) || laws.some(l => l.keys?.length)) {
-        const goals = obligations(m, laws, instances);
-        laws.forEach((law, i) => { instances[law.name] = withReads(laws, instances[law.name], mapKeys(goals.slice(2 * i, 2 * i + 2)), [...(law.forall ? [`${law.forall}#`] : []), ...(law.keys ?? [])]); });
-    }
+    // Each law's two goals (start and step) get their own instances, seeded with its own keys.
+    const keys = [...readKeys(m, laws), ...witnesses(m)], instances = {};
+    laws.forEach((law, i) => {
+        instances[law.name] = instancesFor(m, laws, inst => obligations(m, laws, { ...instances, [law.name]: inst }).slice(2 * i, 2 * i + 2), {
+            seed: [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : []), ...(law.keys ?? []).map((name) => ({ op: 'var', name }))],
+            focus: [...(law.forall ? [`${law.forall}#`] : []), ...(law.keys ?? [])],
+        });
+    });
     const trees = {};
     let nodes = 0, leaves = 0;
     for (const goal of obligations(m, laws, instances)) {
@@ -483,16 +616,19 @@ function proveStepLawsAsGiven(m, laws, stepLaws, base) {
     if (!base.proof)
         return { proven: false, nodes: base.nodes, leaves: base.leaves, checked: false };
     const plain = m.history ? historyMachine(m).machine : m;
-    const keys = [...readKeys(plain, laws), ...witnesses(plain), ...stepLaws.flatMap(sl => [sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC)),
-        ...stepLaws.flatMap(sl => [sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : [])))];
-    let instances = { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : keys])), ...flagInstances(plain, keys) };
-    for (let round = 0; round < 2 && plain.facts?.length; round++)
-        instances = withFacts(plain, instances, fnKeys(plain, stepLaws.flatMap(sl => stepLawObligations(m, laws, instances, sl))));
-    // Where positions shift or a law is about two keys, each step law gets its own instances, from its own goal.
+    // Each step law its own instances, from its own goal: the keys the step and the laws read, and its own (a k-step
+    // law's later frames read keys no other step law has); where positions shift or a law is about several keys, the
+    // keys its goal reads a map at too. A frame's hypotheses read no name the run introduces later (kernel.ts's
+    // stepZone), so a k-step law drops the keys that read one.
+    const shared = [...readKeys(plain, laws), ...witnesses(plain)], named = [...laws, ...(plain.facts ?? [])], reads = shifts(plain) || laws.some(l => l.keys?.length);
+    const own = (sl) => [...[sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC),
+        ...[sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : []))];
     const perStep = {};
-    if (shifts(plain) || laws.some(l => l.keys?.length))
-        for (const sl of stepLaws)
-            perStep[sl.name] = withReads(laws, instances, mapKeys(stepLawObligations(m, laws, instances, sl)), [sl.forall, ...(sl.keys ?? [])].flatMap(k => (k ? [k] : [])));
+    for (const sl of stepLaws) {
+        const zone = stepZone(plain, sl.steps ?? 1), keep = (inst) => avoiding(inst, zone, named);
+        perStep[sl.name] = keep(instancesFor(plain, laws, inst => stepLawObligations(m, laws, keep(inst), sl), { seed: [...shared, ...own(sl)], focus: [sl.forall, ...(sl.keys ?? [])].flatMap(k => (k ? [k] : [])), reads }));
+    }
+    const instances = perStep[stepLaws[0]?.name ?? ''] ?? {};
     const trees = {};
     let nodes = base.nodes, leaves = base.leaves;
     for (const sl of stepLaws)
@@ -514,10 +650,7 @@ export function proveProgress(m, laws, p) {
     if (!base.proven || !base.checked)
         return { proven: false, nodes: base.nodes, leaves: base.leaves, ...(base.failed ? { failed: base.failed } : {}), checked: false };
     const ls = base.laws ?? laws;
-    let instances = { ...withReads(ls, {}, mapKeys(progressObligations(m, ls, {}, p)), []), ...flagInstances(m, mapKeys(progressObligations(m, ls, {}, p))) };
-    instances = { ...instances, ...withReads(ls, instances, mapKeys(progressObligations(m, ls, instances, p)), []) };
-    if (m.facts?.length)
-        instances = withFacts(m, instances, fnKeys(m, progressObligations(m, ls, instances, p)));
+    const instances = instancesFor(m, ls, inst => progressObligations(m, ls, inst, p));
     const trees = {};
     let nodes = base.nodes, leaves = base.leaves;
     for (const goal of progressObligations(m, ls, instances, p)) {
@@ -614,21 +747,12 @@ export function concretize(goal, bound = 12) {
 // The facts a goal needs, as hypotheses: each fact about every key at the keys the goal reads a function at (and at
 // the keys those facts read, a second round), each plain fact as it is.
 export function factsFor(m, goal) {
-    let instances = {};
-    for (let round = 0; round < 2; round++)
-        instances = withFacts(m, instances, fnKeys(m, [{ ...goal, hyps: [...assumed(m.facts ?? [], instances), ...goal.hyps] }]));
-    return assumed(m.facts ?? [], instances);
+    return assumed(m.facts ?? [], instancesFor(m, [], inst => [{ ...goal, hyps: [...assumed(m.facts ?? [], inst), ...goal.hyps] }]));
 }
 // A goal built from its instances (an exporter's goal, shaped as its Lean twin builds it): the every-key laws, the
 // quantified flags and the facts assumed at every key it reads a map or function at, then a tree, checked.
 export function proveBuilt(m, laws, build) {
-    let instances = {};
-    for (let round = 0; round < 2; round++) {
-        const g = build(instances), keys = mapKeys([g]);
-        instances = { ...withReads(laws, instances, keys, []), ...flagInstances(m, keys) };
-        if (m.facts?.length)
-            instances = withFacts(m, instances, fnKeys(m, [build(instances)]));
-    }
+    const instances = instancesFor(m, laws, inst => [build(inst)]);
     const goal = build(instances), out = grow(goal);
     if (!('tree' in out) || !check(goal, out.tree))
         return { proven: false };

package/dist/lean-kernel/emit.d.ts

@@ -59,7 +59,7 @@ export declare function mmachineToLean(id: string, m: Machine, laws: Law[], opts
     stepLaws?: StepLaw[];
 }): string;
 export declare const hasSets: (m: Machine) => boolean;
-export declare function smachineToLean(id: string, m: Machine, laws: Law[], opts?: {
+export declare function smachineToLean(id: string, given: Machine, laws: Law[], opts?: {
     stepLaws?: StepLaw[];
     liveness?: Liveness[];
     tamper?: {
@@ -70,6 +70,14 @@ export declare function smachineToLean(id: string, m: Machine, laws: Law[], opts
     free?: string[];
     ghosts?: string[];
     after?: (ix: (name: string) => number) => string;
+    historyTampers?: {
+        what: string;
+        relations: {
+            when: C;
+            holds: C;
+        }[];
+        withRecordTrees: boolean;
+    }[];
     refined?: {
         impl: Machine;
         spec: Machine;
@@ -77,8 +85,15 @@ export declare function smachineToLean(id: string, m: Machine, laws: Law[], opts
         stutter: C;
         specPre: number;
     };
+    loop?: {
+        loop: Loop;
+        tamper?: {
+            what: string;
+            loop: Loop;
+        };
+    };
 }): string;
-export declare function hmachineToLean(id: string, pruned: Machine, laws: Law[], tampers?: {
+export declare function hmachineToLean(id: string, m: Machine, laws: Law[], tampers?: {
     what: string;
     relations: {
         when: C;