gdp-wired 0.5.0 → 0.7.0

package/dist/lean-kernel/emit.js

@@ -1,6 +1,6 @@
 import { atMost, n, not, pointWrite } from "../core/machine.js";
 import { add, k, scale, sub } from "../core/solver.js";
-import { canon, columnTerm, stateName, termColumn, historyMachine, foldObligations, leafConstraints, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, withProducts } from "../kernel/kernel.js";
+import { canon, columnTerm, stateName, termColumn, historyMachine, foldObligations, leafConstraints, loopLiveness, loopMachine, linear, livenessHelpful, livenessParts, livenessRanks, loopObligations, trueC, obligations, progressObligations, stepLawObligations, substC, withProducts } from "../kernel/kernel.js";
 import { grow, proveBuilt, proveLaws, proveStepLaws } from "../kernel/prove.js";
 import { refinement, refinementSides } from "../core/compose.js";
 import { leanTerms } from "./lean-terms.js";
@@ -244,36 +244,11 @@ theorem ${id}_laws : ∀ maps ρ, Reach ${id}_machine maps ρ → ∀ l ∈ ${id
 export const TRUE = '.le (.const 0) (.const 0)';
 export const grown = (g) => { const o = grow(g); if (!('tree' in o))
     throw new Error(`${g.name}: stuck`); return o.tree; };
-// Loops through Kern.loop_sound: Lean builds the invariant and rank goals from the loop; the trees are the kernel's.
+// Loops through Kern.loop_halts_of: the loop's machine (Live.lean's Loop.machine) with its invariants as laws, and its
+// halting as a liveness (kernel.ts's loopMachine, loopLiveness); the trees are the kernel's.
 export function loopToLean(id, l, laws, rank, tamper) {
-    const vars = [...l.params, ...l.inputs, ...Object.keys(l.state)];
-    const gs = loopObligations(l, laws, rank);
-    const enc = (g, tree = grown(g)) => encode({ name: `${id}: ${g.name}`, goal: g, tree }, false, true, vars);
-    const any0 = enc(gs[0], { leaf: [] });
-    const ix = (name) => vars.indexOf(name);
-    const lit = (lp) => `⟨${list(lp.inputs.map(name => String(ix(name))))},
-  ${list(Object.entries(lp.state).map(([name, e]) => `(${ix(name)}, ${any0.e(e)})`))},
-  ${list(Object.entries(lp.body).map(([name, e]) => `(${ix(name)}, ${any0.e(e)})`))},
-  ${any0.c(lp.while)},
-  ${lp.pre ? any0.c(lp.pre) : TRUE},
-  ${lp.assume ? any0.c(lp.assume) : TRUE}⟩`;
-    const proof = laws.map((law, j) => {
-        const s2 = enc(gs[2 * j]), t = enc(gs[2 * j + 1]);
-        return `(${any0.c(law.holds)},\n  (${s2.tab}, ${s2.tree}),\n  (${t.tab}, ${t.tree}))`;
-    });
-    const r = enc(gs.at(-1));
-    const ranks = Array.isArray(rank) ? rank : [rank];
-    return `-- ${l.name}: halts with ranks ${JSON.stringify(ranks.length)}${laws.length ? `, invariants ${laws.map(law => law.name).join('; ')}` : ''}  (variables ${vars.map((v2, j) => `${j} ${v2}`).join(', ')})
-def ${id}_loop : Loop := ${lit(l)}
-def ${id}_proof : LoopProof := ⟨${list(proof)},
-  ${list(ranks.map(any0.e))},
-  (${r.tab}, ${r.tree})⟩
-theorem ${id}_halts : ∀ maps ρ0, evalC ρ0 maps ${id}_loop.pre = true →
-    ¬ ∃ f : Nat → Nat → Nat, f 0 = applyS ${id}_loop.init ρ0 maps ∧ ∀ n, Turn ${id}_loop maps (f n) (f (n + 1)) :=
-  loop_sound ${id}_loop ${id}_proof (by decide +kernel)${tamper ? `
--- TAMPERED: ${tamper.what}. Lean computes the check to false.
-def ${id}_tampered : Loop := ${lit(tamper.loop)}
-example : checkLoop ${id}_tampered ${id}_proof = false := by decide +kernel` : ''}`;
+    loopObligations(l, laws, rank);
+    return smachineToLean(id, loopMachine(l), laws, { liveness: [loopLiveness(l, rank)], loop: { loop: l, ...(tamper ? { tamper } : {}) } });
 }
 // Folds through Kern.fold_sound: Lean builds the leaf and node goals; the trees are the kernel's.
 export function foldToLean(id, f, laws, extra = '') {
@@ -441,7 +416,8 @@ theorem ${pc.id}_holds : ProgressHolds ${id}_machine ${pc.id} :=
 def ${pc.id}_tampered : Progress := ${record(pc.tamper.when)}
 example : checkProgress ${id}_machine ${id}_proof ${pc.id}_tampered = false := by decide +kernel` : ''}`;
     });
-    // Step laws through Kern.steplaw_sound: `when` and `then` sent with the flags inlined (as kernel.ts's goal has them).
+    // Step laws through Kern.steplaw_sound: `when` and `then` sent with the flags inlined (as kernel.ts's goal has them);
+    // a law over several steps goes through smachineToLean.
     const sp = opts.stepLaws?.length ? proveStepLaws(m, laws, opts.stepLaws) : undefined;
     if (opts.stepLaws?.length && (!sp?.proven || !sp.proof))
         throw new Error(`${id}: step laws not proven`);
@@ -452,9 +428,11 @@ example : checkProgress ${id}_machine ${id}_proof ${pc.id}_tampered = false := b
         const insts = laws.flatMap((l, li) => (l.forall ? (sp.proof.instances[l.name] ?? []).map(key => `(${li}, ${any0.e(key)})`) : []));
         const primes = list(Object.keys(m.state).map(s2 => `(${ix(s2)}, ${ix(`${s2}'`)})`)), primeMaps = list(baseMaps.map(mp => `(${mapNames.indexOf(mp)}, ${mapNames.indexOf(`${mp}'`)})`));
         const k = sl.steps ?? 1;
-        if (k === 1 && !Array.isArray(sl.when))
-            return `-- Step law: ${sl.name}
-def ${id}_step${j} : StepLaw := ⟨${sl.when ? any0.c(inlineFlags(sl.when)) : TRUE},
+        const when = Array.isArray(sl.when) ? sl.when[0] : sl.when;
+        if (k !== 1)
+            throw new Error(`${id}: step law ${sl.name}: a law over several steps goes through smachineToLean (Sets.lean's skstep_sound)`);
+        return `-- Step law: ${sl.name}
+def ${id}_step${j} : StepLaw := ⟨${when ? any0.c(inlineFlags(when)) : TRUE},
   ${any0.c(inlineFlags(sl.then))},
   ${primes},
   ${primeMaps},
@@ -462,19 +440,6 @@ def ${id}_step${j} : StepLaw := ⟨${sl.when ? any0.c(inlineFlags(sl.when)) : TR
   (${pr.tab}, ${pr.tree})⟩
 theorem ${id}_step${j}_holds : StepLawHolds ${id}_machine ${id}_step${j} :=
   steplaw_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by decide +kernel)`;
-        // Through Kern.kstep_sound (Steps.lean): one `when` per step (0 <= 0 where none), the j-th request's inputs renamed.
-        const whens = sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when];
-        const ren = Array.from({ length: k }, (_, s2) => (s2 === 0 ? '[]' : list(m.inputs.map(i => `(${ix(i)}, ${ix(`${i}@${s2 + 1}`)})`))));
-        return `-- Step law over ${k} steps: ${sl.name}
-def ${id}_step${j} : KStep := ⟨${list(Array.from({ length: k }, (_, s2) => (whens[s2] ? any0.c(inlineFlags(whens[s2])) : TRUE)))},
-  ${any0.c(inlineFlags(sl.then))},
-  ${list(ren)},
-  ${primes},
-  ${primeMaps},
-  ${list(insts)},
-  (${pr.tab}, ${pr.tree})⟩
-theorem ${id}_step${j}_holds : KStepHolds ${id}_machine ${id}_step${j} :=
-  kstep_sound ${id}_machine ${id}_proof ${id}_step${j} ${id}_check (by decide +kernel)`;
     });
     const machineDef = `def ${id}_machine : FMMachine := ${lit(m)}`;
     return `-- ${m.name}: ${laws.map(l => l.name).join('; ')}${flagNames.length ? `, with flags ${flagNames.join(', ')}` : ''}  (variables ${vars.map((v2, j) => `${j} ${v2}`).join(', ')}; maps ${mapNames.map((v2, j) => `${j} ${v2}`).join(', ')})
@@ -503,7 +468,13 @@ const flagsOfM = (m) => {
 export const hasSets = (m) => !!m.inputMaps?.length || Object.values(m.step.flags ?? {}).some(c => c.op === 'all') || Object.values(m.step.maps ?? {}).some(w => 'each' in w)
     || !!Object.keys(m.fns ?? {}).length || !!m.facts?.length;
 const boundKeys = (m) => [...Object.values(m.step.flags ?? {}).flatMap(c => (c.op === 'all' ? [c.key] : [])), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : []))];
-export function smachineToLean(id, m, laws, opts = {}) {
+// A machine with a history goes as its plain machine (kernel.ts's historyMachine: sums as state, queries as inputs,
+// the relations assumed), built in Lean from the machine and its history (History.lean's HMachine.plain), so every claim
+// below is about it; with the relations' record goals, its laws hold over histories too (hmachine_sound).
+// `historyTampers`: the history with other relations, each refused.
+export function smachineToLean(id, given, laws, opts = {}) {
+    const hm = given.history ? { ...given, history: { ...given.history, prune: undefined } } : undefined;
+    const hplain = hm ? historyMachine(hm) : undefined, m = hplain ? hplain.machine : given;
     const stepLaws = opts.stepLaws ?? [], rf = opts.refined, gv = opts.ghosts ?? [];
     const claims = [];
     const claimSteps = () => claims.flatMap(cl => cl.steps);
@@ -577,6 +548,19 @@ theorem ${lid}_holds (run : SRun ${id}_machine)
   sleads_sound ${id}_machine ${id}_proof ${lid} _ _ _ ${id}_check ${lid}_ok ${lid}_stay ${lid}_cover ${lid}_helps run fair${wf}`;
             } });
     }
+    // A loop (Live.lean's loop_halts_of): its machine is the loop's, and its liveness says the loop halts.
+    const lp0 = opts.loop;
+    if (lp0)
+        claims.push({ steps: [], allows: [], render: () => `/-- ${lp0.loop.name} halts: for params meeting its precondition, no run of turns goes on forever. -/
+theorem ${id}_halts : ∀ maps ρ0, evalC ρ0 maps ${id}_loop.pre = true →
+    ¬ ∃ f : Nat → Nat → Nat, f 0 = applyS ${id}_loop.init ρ0 maps ∧ ∀ n, Turn ${id}_loop maps (f n) (f (n + 1)) :=
+  loop_halts_of ${id}_loop ${id}_live0 rfl rfl (by intro h hh; simp only [${id}_live0, List.mem_singleton] at hh; subst hh; rfl) (by decide +kernel) ${id}_live0_holds${lp0.tamper ? `
+-- TAMPERED: ${lp0.tamper.what}. Lean computes the checks to false.
+def ${id}_tampered : SMachine := Loop.machine ${loopLit(lp0.tamper.loop)}
+example : (checkSMachine ${id}_tampered ${id}_proof && sliveOk ${id}_tampered ${id}_live0
+    && checkSKStep ${id}_tampered ${id}_proof (sliveStep ${id}_live0 ${id}_live0.pend (liveStayC ${id}_live0) ${id}_live0_sp)
+    && checkSKStep ${id}_tampered ${id}_proof (sliveStep ${id}_live0 ${id}_live0.pend (liveCoverC ${id}_live0) ${id}_live0_cp)
+    && sliveHelpsOk ${id}_tampered ${id}_proof ${id}_live0 ${id}_live0_hp) = false := by decide +kernel` : ''}` });
     // Ghosts (Ghost.lean's sghost_laws): the laws that read no ghost hold of the machine without its ghosts.
     if (gv.length)
         claims.push({ steps: [], allows: [], render: () => `-- The laws that read no ghost hold of the machine without its ghosts.
@@ -649,7 +633,7 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
     const vars = [...new Set([...m.params, ...m.inputs, ...Object.keys(m.state), ...keysOf, ...keysOf.map(k2 => `${k2}#`), '#', ...flags.map(([f]) => `?${f}`),
             ...quantified.map(f => `w?${f}`), ...boundKeys(m), ...(opts.tamper ? boundKeys(opts.tamper.machine) : []), ...stepLaws.flatMap(sl => (sl.forall ? [sl.forall] : [])), ...(opts.free ?? []),
             ...primes, ...later, ...Array.from({ length: k - 1 }, (_, j) => Object.keys(m.state).map(n2 => stateName(n2, j + 1))).flat(),
-            ...[...goalsL, ...goalsS, ...allowGoals].flatMap(g => g.hyps.flatMap(varsOf))])];
+            ...(hm ? hm.history.record.map(f => `r.${f}`) : []), ...[...goalsL, ...goalsS, ...allowGoals, ...(hplain?.goals ?? [])].flatMap(g => g.hyps.flatMap(varsOf))])];
     const baseMaps = [...new Set([...Object.keys(m.maps ?? {}), ...Object.keys(m.step.maps ?? {}), ...Object.keys(m.fns ?? {})])];
     const mapNames = [...new Set([...baseMaps, ...carried, ...(allSteps.length ? Object.keys(m.maps ?? {}).map(mp => `${mp}'`) : []), ...laterMaps,
             ...[...JSON.stringify([...goalsL, ...goalsS, ...allowGoals]).matchAll(/"op":"get","map":"([^"]+)"/g)].map(x2 => x2[1])])];
@@ -675,6 +659,39 @@ theorem ${id}_orig_laws : ∀ ρ M, SReach ${id}_ghosted.orig ρ M → ∀ e ∈
   ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${ix(c2.key)}, ${c(c2.c)})`] : [])))},
   ${list(fs.flatMap(([f, c2]) => (c2.op === 'all' ? [`(${ix(`?${f}`)}, ${ix(`w?${f}`)})`] : [])))},
   ${list((mm.facts ?? []).map(l => `⟨${c(l.holds)}, ${l.forall ? `some ${ix(l.forall)}` : 'none'}⟩`))}⟩`;
+    };
+    // A loop as Live.lean's record: inputs, start, body, while, precondition, assumption.
+    const loopLit = (lp) => `⟨${list(lp.inputs.map(name => String(ix(name))))},
+  ${list(Object.entries(lp.state).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
+  ${list(Object.entries(lp.body).map(([name, e2]) => `(${ix(name)}, ${e(e2)})`))},
+  ${c(lp.while)},
+  ${lp.pre ? c(lp.pre) : TRUE},
+  ${lp.assume ? c(lp.assume) : TRUE}⟩`;
+    // The history: the machine without it (its state without the sums, its assumption without the relations), what a
+    // record keeps and the sums, queries and relations over it.
+    const hlit = (rels) => {
+        const h = hm.history, base = { ...hm, history: undefined };
+        return `⟨${lit(base)},
+  ${c(h.keep)},
+  ${list(h.record.map(f => String(ix(f))))},
+  ${list(h.record.map(f => String(ix(`r.${f}`))))},
+  ${list(Object.entries(h.sums).map(([name, g]) => `(${ix(name)}, ${e(g)})`))},
+  ${list(Object.entries(h.queries).map(([name, g]) => `(${ix(name)}, ${e(g)})`))},
+  ${list(rels.map(rel => { if (rel.holds.op !== '<=')
+            throw new Error(`${id}: a relation is a <= b`); return `(${c(rel.when)}, ${e(rel.holds.a)}, ${e(rel.holds.b)})`; }))}⟩`;
+    };
+    // Each relation's record goal and its tree, the history's check, and the laws over histories.
+    const histBlock = () => {
+        const records = hplain.goals.map(g => { const out = grow(g); if (!('tree' in out))
+            throw new Error(`${id}: ${g.name} not proven`); const x2 = enc(g, out.tree); return `(${x2.tab}, ${x2.tree})`; });
+        const tampered = (opts.historyTampers ?? []).map((t, j) => `-- TAMPERED: ${t.what}. Lean computes the check to false.
+def ${id}_tampered${j} : HMachine := ${hlit(t.relations)}
+example : checkHMachine ${id}_tampered${j} ${id}_proof ${t.withRecordTrees ? `${id}_records` : '[]'} = false := by decide +kernel`);
+        return `def ${id}_records : List (List VDef × Tree) := ${list(records)}
+theorem ${id}_hcheck : checkHMachine ${id}_hist ${id}_proof ${id}_records = true := by decide +kernel
+theorem ${id}_hlaws : ∀ ρ M hist, HReach ${id}_hist ρ M hist → ∀ e ∈ ${id}_proof, e.Holds ρ M :=
+  hmachine_sound ${id}_hist ${id}_proof ${id}_records ${id}_hcheck
+${readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat) (hist : List (Nat → Nat))', hyp: `HReach ${id}_hist ρ μ hist`, call: `${id}_hlaws ρ μ hist h` })}${tampered.length ? `\n${tampered.join('\n')}` : ''}`;
     };
     const lawIx = (name) => laws.findIndex(l => l.name === name);
     const insts = (inst) => Object.entries(inst).filter(([name]) => lawIx(name) >= 0 && !laws[lawIx(name)].keys?.length).flatMap(([name, keys]) => keys.map(key => `(${lawIx(name)}, ${e(key)})`));
@@ -716,13 +733,15 @@ ${rf ? `def ${id}_refined : SRefined := ⟨${lit(rf.impl)},
 def ${id}_machine : SMachine := ${id}_refined.full` : gv.length ? `def ${id}_ghosted : SGhosted := ⟨${lit(orig)},
   ${list(gv.map(v2 => `(${ix(v2)}, ${e(m.state[v2])}, ${e(m.step.state?.[v2] ?? { op: 'var', name: v2 })})`))}⟩
 def ${id}_machine : SMachine := ${id}_ghosted.full
-theorem ${id}_ghostOk : sghostOk ${id}_ghosted = true := by decide +kernel` : `def ${id}_machine : SMachine := ${lit(m)}`}
+theorem ${id}_ghostOk : sghostOk ${id}_ghosted = true := by decide +kernel` : hm ? `def ${id}_hist : HMachine := ${hlit(hm.history.relations ?? [])}
+def ${id}_machine : SMachine := ${id}_hist.plain` : lp0 ? `def ${id}_loop : Loop := ${loopLit(lp0.loop)}
+def ${id}_machine : SMachine := ${id}_loop.machine` : `def ${id}_machine : SMachine := ${lit(m)}`}
 ${entries.join('\n')}
 def ${id}_proof : List SEntry := ${list(laws.map((_, j) => `${id}_e${j}`))}
 theorem ${id}_check : checkSMachine ${id}_machine ${id}_proof = true := by decide +kernel
 theorem ${id}_laws : ∀ ρ M, SReach ${id}_machine ρ M → ∀ e ∈ ${id}_proof, e.Holds ρ M :=
   smachine_sound ${id}_machine ${id}_proof ${id}_check
-${readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat)', hyp: `SReach ${id}_machine ρ μ`, call: `${id}_laws ρ μ h` })}${factsProof(id, m, mapNames, opts.simp)}${opts.tamper ? `
+${hm ? histBlock() : readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat)', hyp: `SReach ${id}_machine ρ μ`, call: `${id}_laws ρ μ h` })}${factsProof(id, m, mapNames, opts.simp)}${opts.tamper ? `
 -- TAMPERED: ${opts.tamper.what}. Lean computes the check to false.
 def ${id}_tampered : SMachine := ${lit(opts.tamper.machine)}
 example : checkSMachine ${id}_tampered ${id}_proof = false := by decide +kernel` : ''}${records.length ? `\n\n${records.join('\n\n')}` : ''}${opts.after ? `\n\n${opts.after(ix)}` : ''}`;
@@ -745,61 +764,9 @@ theorem ${id}_facts_hold (ρ : Nat → Nat) (μ : Nat → Nat → Nat) ${fns.map
 // relations in the assumption) and each relation's record goal; the trees and the instance keys are the kernel's.
 // Pruning is left out: its goals are about the runtimes (dropping a record changes no query), the laws and relations
 // are proven over the whole history either way, and Lean's HMachine has no pruning; the TypeScript kernel checks them.
-export function hmachineToLean(id, pruned, laws, tampers = [], corollary) {
-    const m = { ...pruned, history: { ...pruned.history, prune: undefined } };
-    const h = m.history;
-    const r = proveLaws(m, laws);
-    if (!r.proven || !r.proof)
-        throw new Error(`${id}: not proven`);
-    const keysOf = [...new Set(laws.flatMap(l => (l.forall ? [l.forall] : [])))];
-    const flagNames = Object.keys(m.step.flags ?? {});
-    const sums = Object.keys(h.sums), fields = h.record.map(f => `r.${f}`);
-    const vars = [...m.params, ...m.inputs, ...Object.keys(m.state), ...sums, ...keysOf, ...keysOf.map(k2 => `${k2}#`), '#', ...flagNames.map(f => `?${f}`), ...fields];
-    const mapNames = [...new Set([...Object.keys(m.maps ?? {}), ...Object.keys(m.step.maps ?? {}), ...[...JSON.stringify(laws).matchAll(/"op":"get","map":"([^"]+)"/g)].map(x2 => x2[1])])];
-    const gs = obligations(m, laws, r.proof.instances);
-    const enc = (g, tree = r.proof.trees[g.name]) => encode({ name: `${id}: ${g.name}`, goal: g, tree }, false, true, vars, mapNames);
-    const any0 = enc(gs[0], { leaf: [] });
-    const ix = (name) => { const j = vars.indexOf(name); if (j < 0)
-        throw new Error(`${id}: no variable ${name}`); return j; };
-    const rels = (rs) => list(rs.map(rel => {
-        if (rel.holds.op !== '<=')
-            throw new Error(`${id}: a relation is a <= b`);
-        return `(${any0.c(rel.when)}, ${any0.e(rel.holds.a)}, ${any0.e(rel.holds.b)})`;
-    }));
-    const lit = (rs) => `⟨⟨⟨${list(m.inputs.map(name => String(ix(name))))},
-  ${list(Object.entries(m.state).map(([name, e]) => `(${ix(name)}, ${any0.e(e)})`))},
-  ${list(Object.entries(m.maps ?? {}).map(([name, c2]) => `(${mapNames.indexOf(name)}, ${c2})`))},
-  ${list(Object.entries(m.step.state ?? {}).map(([name, e]) => `(${ix(name)}, ${any0.e(e)})`))},
-  ${list(Object.entries(m.step.maps ?? {}).map(([name, w]) => { const pw = pointWrite(w, 'Lean (for now)'); return `(${mapNames.indexOf(name)}, ${any0.e(pw.key)}, ${any0.e(pw.value)})`; }))},
-  ${m.pre ? any0.c(m.pre) : TRUE},
-  ${m.assume ? any0.c(m.assume) : TRUE}⟩,
-  ${list(flagNames.map(f => `(${ix(`?${f}`)}, ${any0.c(m.step.flags[f])})`))}⟩,
-  ${any0.c(h.keep)},
-  ${list(h.record.map(f => String(ix(f))))},
-  ${list(fields.map(f => String(ix(f))))},
-  ${list(Object.entries(h.sums).map(([name, g]) => `(${ix(name)}, ${any0.e(g)})`))},
-  ${list(Object.entries(h.queries).map(([name, g]) => `(${ix(name)}, ${any0.e(g)})`))},
-  ${rels(rs)}⟩`;
-    const entries = laws.map((law, j) => {
-        const a = enc(gs[2 * j]), b = enc(gs[2 * j + 1]);
-        const insts = Object.entries(r.proof.instances[law.name] ?? {}).flatMap(([lname, keys]) => keys.map(key => `(${laws.findIndex(l => l.name === lname)}, ${any0.e(key)})`));
-        return `def ${id}_l${j} : MLaw := ⟨${any0.c(law.holds)}, ${law.forall ? `some ${ix(law.forall)}` : 'none'}⟩\ndef ${id}_e${j} : MEntry := ⟨${id}_l${j}, ${ix(law.forall ? `${law.forall}#` : '#')}, ${list(insts)},\n  (${a.tab}, ${a.tree}),\n  (${b.tab}, ${b.tree})⟩`;
-    });
-    const records = gs.slice(2 * laws.length).map(g => { const x2 = enc(g); return `(${x2.tab}, ${x2.tree})`; });
-    const tamperText = tampers.map((t, j) => `-- TAMPERED: ${t.what}. Lean computes the check to false.
-def ${id}_tampered${j} : HMachine := ${lit(t.relations)}
-example : checkHMachine ${id}_tampered${j} ${id}_proof ${t.withRecordTrees ? `${id}_records` : '[]'} = false := by decide +kernel`);
-    return `-- ${m.name}: ${laws.map(l => l.name).join('; ')}, with a history (sums ${sums.join(', ')}; queries ${Object.keys(h.queries).join(', ')}; ${(h.relations ?? []).length} relation(s))
---   (variables ${vars.map((v2, j) => `${j} ${v2}`).join(', ')}; maps ${mapNames.map((v2, j) => `${j} ${v2}`).join(', ')})
-def ${id}_machine : HMachine := ${lit(h.relations ?? [])}
-${entries.join('\n')}
-def ${id}_proof : List MEntry := ${list(laws.map((_, j) => `${id}_e${j}`))}
-def ${id}_records : List (List VDef × Tree) := ${list(records)}
-theorem ${id}_check : checkHMachine ${id}_machine ${id}_proof ${id}_records = true := by decide +kernel
-theorem ${id}_laws : ∀ ρ M hist, HReach ${id}_machine ρ M hist → ∀ e ∈ ${id}_proof, e.law.Holds ρ M :=
-  hmachine_sound ${id}_machine ${id}_proof ${id}_records ${id}_check
-${readable(id, laws, vars, mapNames, { binders: '(ρ : Nat → Nat) (μ : Nat → Nat → Nat) (hist : List (Nat → Nat))', hyp: `HReach ${id}_machine ρ μ hist`, call: `${id}_laws ρ μ hist h` })}${corollary ? `\n${corollary(ix)}` : ''}
-${tamperText.join('\n')}`;
+// A machine with a history: its laws over histories (History.lean's hmachine_sound), through smachineToLean.
+export function hmachineToLean(id, m, laws, tampers = [], corollary) {
+    return smachineToLean(id, m, laws, { historyTampers: tampers, ...(corollary ? { after: corollary } : {}) });
 }
 // A Lean file proving each item, to compile against the twin (`leanLibrary`, or `leanProject` for a ready Lake project).
 // Each machine's laws come with `<id>_laws` (the twin's theorem) and `<id>.lawN` (the law as a plain Lean statement
@@ -822,23 +789,11 @@ export function toLean(items, opts = {}) {
                     throw new Error(`${item.id}: not proven (${r.failed?.stuck ?? ''})`);
                 item = { ...item, laws: r.laws ?? item.laws, ...(item.stepLaws ? { stepLaws: r.stepLaws ?? item.stepLaws } : {}) };
             }
-            if (m.history && (m.fns || m.facts))
-                throw new Error(`${item.id}: functions on a machine with a history aren't exported to Lean yet`);
-            // One twin: a machine without a history goes to Lean as a machine with sets (one with none, if it has none): its laws,
-            // step laws, liveness and ghosts in one export. A history's laws go through History.lean, and its step laws and
-            // liveness through its plain machine (its sums as state, its queries as inputs).
-            if (m.history) {
-                parts.push(`-- ${item.id}\n${hmachineToLean(id, m, item.laws)}`);
-                theorems.push(`${id}_laws`);
-                if (item.stepLaws?.length || item.liveness?.length) {
-                    parts.push(`-- ${item.id}: step laws and liveness, on its plain machine\n${smachineToLean(`${id}s`, historyMachine(m).machine, item.laws, { stepLaws: item.stepLaws, ...(item.liveness?.length ? { liveness: item.liveness } : {}) })}`);
-                    theorems.push(...(item.stepLaws ?? []).map((_, j) => `${id}s_step${j}_holds`), ...(item.liveness ?? []).map((_, j) => `${id}s_live${j}_holds`));
-                }
-                continue;
-            }
+            // One twin: every machine goes to Lean as a machine with sets (one with none, if it has none): its laws, step laws,
+            // liveness and ghosts in one export; a machine with a history as its plain machine, and its laws over histories.
             parts.push(`-- ${item.id}\n${item.lean?.defs ? `${item.lean.defs}\n` : ''}${smachineToLean(id, m, item.laws, { stepLaws: item.stepLaws, ...(item.liveness?.length ? { liveness: item.liveness } : {}),
                 ...(item.ghosts?.length ? { ghosts: item.ghosts } : {}), ...(item.lean?.simp ? { simp: item.lean.simp } : {}), ...(item.lean?.after ? { after: item.lean.after } : {}) })}`);
-            theorems.push(`${id}_laws`, ...(item.stepLaws ?? []).map((_, j) => `${id}_step${j}_holds`), ...(item.liveness ?? []).map((_, j) => `${id}_live${j}_holds`));
+            theorems.push(`${id}_laws`, ...(m.history ? [`${id}_hlaws`] : []), ...(item.stepLaws ?? []).map((_, j) => `${id}_step${j}_holds`), ...(item.liveness ?? []).map((_, j) => `${id}_live${j}_holds`));
             if (item.lean?.after)
                 theorems.push(...[...item.lean.after(() => 0).matchAll(/^theorem (\S+)/gm)].map(x2 => x2[1]));
         }
@@ -863,9 +818,9 @@ export function toLean(items, opts = {}) {
             theorems.push(id);
         }
     }
-    // Sets.lean (which imports Steps.lean) only when a machine has sets.
+    // The file the items need: Live.lean for a liveness or a loop, Sets.lean (which imports Steps.lean) for any machine.
     return `import History
-import ${items.some(item => 'refinement' in item) ? 'Refine' : items.some(item => 'machine' in item && item.ghosts?.length) ? 'Ghost' : items.some(item => 'machine' in item && item.liveness?.length) ? 'Live' : items.some(item => 'machine' in item) ? 'Sets' : 'Steps'}
+import ${items.some(item => 'refinement' in item) ? 'Refine' : items.some(item => 'machine' in item && item.ghosts?.length) ? 'Ghost' : items.some(item => ('machine' in item && item.liveness?.length) || 'loop' in item) ? 'Live' : items.some(item => 'machine' in item) ? 'Sets' : 'Steps'}
 open Kern Cert
 set_option maxRecDepth 100000
 set_option maxHeartbeats 0