gdp-wired 0.9.0 → 0.10.1

package/README.md

@@ -67,6 +67,10 @@ All of these are proven automatically, and each proof is also a Lean theorem:
 - **Records and variants**: inputs, state, results, map cells and list items made of named fields, or one of several
   cases each with fields of its own (a payment by card or in cash, a seat free, held or sold), every case covered
   (`examples/datatypes.ts`).
+- **Lists a request carries, and trees**: an invoice's lines, with folds over them (the total, the taxable part) and
+  lemmas about the folds proven by induction over the lines (`examples/invoices.ts`); a fold over a tree as a value (a
+  spend roll-up over an org chart, sign-offs over a document's sections), its laws proven by induction over the tree
+  (`examples/folds.ts`).
 - **Pure functions and two-run laws**: laws about what a function returns, and laws comparing two calls, like "the
   secret never changes the answer". `examples/jev-fabric/` ports a Bend project's policy core and proves all 59 laws its
   Bend proofs state.
@@ -218,7 +222,19 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   twin see nothing new. Maps and lists of them: `.maps({Acct: record({...}).from({...})})` (`Acct.at(k)`,
   `Acct.set(k, value)`, `Acct.each(k => value)`) and `.items({Queue: Job})` (`push`, `pop`, `set`, `insertAt`,
   `removeAt`, `apply`, `has`, `within`, `increasing(by)`), one map per variable of the kind; `rule.decode` reads them back
-  as objects and arrays. Not as values: recursive types (a tree).
+  as objects and arrays.
+- **Lists a request carries** (`.carriesList('Lines', Line, folds, lemmas)`): the items one carried map per variable of
+  the kind, the length `Lines.len`, each fold (`{total: {from: 0, step: (acc, line) => acc.plus(line.amount)}}`) a
+  carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
+  array, and a request that doesn't meet them isn't allowed), read as `Lines.fold.total`; `Lines.every`, `some`, `has`,
+  `increasing(by)`, `at(i)`. A lemma about the folds (`({taxed, total}) => taxed.atMost(total)`) is proven by induction
+  over the items when the rule is built, then assumed at every prefix (`examples/invoices.ts`).
+- **Folds over trees** (`fold(name).params(...).inputs(...).leaf(env => ({...})).node((env, left, right) => ({...}))`,
+  `proveFold`): a tree as a value (`{leaf: inputs}` or `{node: inputs, left, right}`), each leaf's values from its inputs
+  and each node's from its own and its children's; a law about the values is proven by induction over the tree (the
+  kernel's leaf and node goals, Lean's `fold_sound`), `f.run(tree, params)` evaluates the terms proven and `f.crossCheck`
+  holds the builders to them (`examples/folds.ts`). A tree in a rule's state, and claims that need a lemma about the
+  tree's shape nobody stated, stay Lean's.
 - **State of any kind**: `.state({open: bool.from(true), status: oneOf('new', 'done').from('new'), owner: str().from(''), note: maybe(nat).from(null)})`;
   a step writes each kind's own values, `when(c, a, b)` chooses between any two values of a kind, and `rule.decode(state)`
   reads them back as runtime values.
@@ -313,7 +329,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |

package/dist/core/dsl.d.ts

@@ -1,5 +1,5 @@
 import { type C, type E, type Law, type Recurrence, type Machine, type Request, type State } from './machine.js';
-import { type Goal, type Liveness, type Loop, type StepLaw, type Tree } from '../kernel/kernel.js';
+import { type Fold, type Goal, type Liveness, type Loop, type StepLaw, type Tree } from '../kernel/kernel.js';
 export type TermLike = Term | number;
 export declare const termOf: (t: TermLike) => E;
 export declare class Term {
@@ -310,6 +310,35 @@ export type ItemsOp = {
     readonly parts: Record<string, ListOp>;
     readonly len: TermLike;
 };
+export type ListFold<V> = {
+    from: number;
+    step: (acc: Term, item: V) => TermLike;
+};
+export type ListLemma = (acc: Record<string, Term>, i: Term) => Cond;
+export declare class CarriedList<V, Fd extends string = never> {
+    readonly name: string;
+    readonly kind: Kind<V>;
+    readonly len: Term;
+    readonly folds: Record<Fd, ListFold<V>>;
+    private readonly map;
+    readonly lemmas: Record<string, ListLemma>;
+    readonly fold: Record<Fd, Term>;
+    constructor(name: string, kind: Kind<V>, len: Term, folds: Record<Fd, ListFold<V>>, map: (part: string) => MapRef, lemmas?: Record<string, ListLemma>);
+    at(i: TermLike): V;
+    after(fold: Fd, i: TermLike): Term;
+    every(f: (item: V, i: Term) => Cond): Cond;
+    some(f: (item: V, i: Term) => Cond): Cond;
+    has(x: V): Cond;
+    increasing(by: (item: V) => Term): Cond;
+    equations(): Cond[];
+    private running;
+    prove(): Verdict;
+    get maps(): string[];
+    encode(raw: Raw): {
+        maps: Record<string, Map<number, number>>;
+        len: number;
+    };
+}
 export declare class ItemsRef<V> {
     readonly name: string;
     readonly kind: Kind<V>;
@@ -392,6 +421,7 @@ type Spec = {
     items?: [string, Kind<unknown>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
+    lists2?: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
     fns?: [string, FnDef][];
     facts?: ((env: never) => Record<string, Cond | Forall>)[];
     flags: ((env: never) => Record<string, Cond>)[];
@@ -444,6 +474,9 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     carries<const N extends string>(...names: N[]): Rule<P, I & {
         [k in N]: MapRef;
     }, S, M, F, R, Su, Q>;
+    carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term) => Cond>): Rule<P, I & {
+        [k in N]: CarriedList<V, Fd>;
+    }, S, M, F, R, Su, Q>;
     flags<T extends Record<string, Cond>>(f: (env: P & I & S & M & F & Su & Q) => T): Rule<P, I, S, M, F & {
         [k in keyof T]: Cond;
     }, R, Su, Q>;
@@ -516,7 +549,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
         [k in keyof P]: Raw;
     }): Record<string, number>;
     encodeInput(values: {
-        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : Raw;
+        [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
     }): Request;
     randomParams(rand: Rand, bound: number): Record<string, number>;
     randomInput(rand: Rand, bound: number): Request;
@@ -690,3 +723,55 @@ export declare function crossCheckDecision(d: Decision, opts?: {
     failure?: string;
 };
 export declare const proveLoop: (l: LoopRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;
+export type TreeValue<I> = {
+    leaf: I;
+} | {
+    node: I;
+    left: TreeValue<I>;
+    right: TreeValue<I>;
+};
+type FoldSpec = {
+    name: string;
+    params: [string, Kind<unknown>][];
+    inputs: [string, Kind<unknown>][];
+    pre: ((p: never) => Cond)[];
+    assume: ((env: never) => Cond)[];
+    leaf?: (env: never) => Record<string, TermLike>;
+    node?: (env: never, left: never, right: never) => Record<string, TermLike>;
+};
+export declare class FoldRule<P extends Obj = {}, I extends Obj = {}, S extends Obj = {}> {
+    private readonly spec;
+    constructor(spec: FoldSpec);
+    private with;
+    get name(): string;
+    params<K extends Kinds>(kinds: K): FoldRule<P & ValuesOf<K>, I, S>;
+    inputs<K extends Kinds>(kinds: K): FoldRule<P, I & ValuesOf<K>, S>;
+    pre(f: (p: P) => Cond): FoldRule<P, I, S>;
+    assume(f: (env: P & I) => Cond): FoldRule<P, I, S>;
+    leaf<T extends Record<string, TermLike>>(f: (env: P & I) => T): FoldRule<P, I, {
+        [k in keyof T]: Term;
+    }>;
+    node(f: (env: P & I, left: S, right: S) => {
+        [k in keyof S]: TermLike;
+    }): FoldRule<P, I, S>;
+    private env;
+    private names;
+    private side;
+    law(name: string, f: (env: P & S) => Cond): Law;
+    get fold(): Fold;
+    run(tree: TreeValue<{
+        [k in keyof I]: Raw;
+    }>, params?: {
+        [k in keyof P]?: Raw;
+    }): {
+        [k in keyof S]: number;
+    };
+    crossCheck(laws?: Law[], opts?: {
+        trials?: number;
+        depth?: number;
+        bound?: number;
+        rand?: Rand;
+    }): Agreement;
+}
+export declare const fold: (name: string) => FoldRule;
+export declare const proveFold: (f: FoldRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;

package/dist/core/dsl.js

@@ -15,9 +15,9 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { carriedView, compileFunction, evalC, interpret, loadJs, numbersOf } from "./machine.js";
+import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf } from "./machine.js";
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
-import { check, loopObligations } from "../kernel/kernel.js";
+import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
@@ -867,6 +867,89 @@ export class CellsRef {
         return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).each(k => partsOf(this.kind, this.name, f(k))[part])])) };
     }
 }
+export class CarriedList {
+    name;
+    kind;
+    len;
+    folds;
+    map;
+    lemmas;
+    fold;
+    constructor(name, kind, len, folds, map, lemmas = {}) {
+        this.name = name;
+        this.kind = kind;
+        this.len = len;
+        this.folds = folds;
+        this.map = map;
+        this.lemmas = lemmas;
+        this.fold = Object.fromEntries(Object.keys(folds).map(f => [f, map(`${name}$${f}`).at(len)]));
+    }
+    at(i) { return this.kind.build(this.name, part => this.map(part).at(i)); }
+    // The running value of a fold after the first i items.
+    after(fold, i) { return this.map(`${this.name}$${fold}`).at(i); }
+    every(f) { return everyKey(k => k.lt(this.len).implies(f(this.at(k), k))); }
+    some(f) { return this.every((x, i) => f(x, i).not()).not(); }
+    has(x) { return this.some(y => same(y, x)); }
+    // Each item's `by` below the next one's (so no two alike).
+    increasing(by) { return everyKey(k => k.plus(1).lt(this.len).implies(by(this.at(k)).lt(by(this.at(k.plus(1)))))); }
+    // What every request is assumed to meet: each fold's start, and at every key one condition (the item's own laws and
+    // each fold's step below the length, each lemma up to it), so the prover closes one quantifier, not one per part.
+    equations() {
+        const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
+        const at = (k) => {
+            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x)));
+            const below = [...this.kind.invariant(x), ...steps];
+            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k))))] : []));
+        };
+        const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
+        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(d.from)), ...(any ? [everyKey(at)] : [])];
+    }
+    running(k) { return Object.fromEntries(Object.keys(this.folds).map(f => [f, this.after(f, k)])); }
+    // The lemmas, proven: the folds as a machine counting i up from 0 over items that are functions of i known only by
+    // the kind's own laws, each lemma a law of it (so it holds after every prefix of every list).
+    prove() {
+        if (!Object.keys(this.lemmas).length)
+            return { proven: true, checked: true };
+        const parts = this.kind.vars(this.name), fname = (p) => `item$${p.replaceAll('.', '$')}`;
+        const item = (i) => this.kind.build(this.name, p => new Term({ op: 'get', map: fname(p), key: i.e }));
+        // Every item is a value of the kind (its own laws, as a fact of the first part's function).
+        const kindFact = this.kind.invariant(this.kind.value(this.name)).length ? { 'every item is a value of its kind': forall(k => all(...this.kind.invariant(item(k)))) } : {};
+        const fns = Object.fromEntries(parts.map((p, j) => [fname(p), fn(1, 'x => 0', j === 0 ? { facts: () => kindFact } : {})]));
+        const folds = Object.entries(this.folds);
+        const r = rule(`${this.name}'s folds, by induction`).fns(fns).inputs({}).state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.from])) })
+            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i))])) }));
+        const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i))));
+    }
+    // Every carried map it is kept in: the items' parts, then each fold's.
+    get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
+    // A request's list as those maps and its length: each fold computed by its step, as the builders compute it.
+    encode(raw) {
+        if (!Array.isArray(raw))
+            throw new RangeError(`${this.name} must be a list, not ${shown(raw)}`);
+        const items = raw.map(x => this.kind.encode(this.name, x));
+        const maps = Object.fromEntries(this.maps.map(m => [m, new Map()]));
+        items.forEach((enc, i) => { for (const [part, x] of Object.entries(enc))
+            if (x !== 0)
+                maps[part].set(i, x); });
+        for (const [f, d] of Object.entries(this.folds)) {
+            const acc = maps[`${this.name}$${f}`];
+            let value = d.from;
+            if (value !== 0)
+                acc.set(0, value);
+            items.forEach((enc, i) => {
+                const item = this.kind.build(this.name, part => new Term({ op: 'const', value: enc[part] }, enc[part]));
+                const next = valOf(d.step(new Term({ op: 'const', value }, value), item));
+                if (next === undefined || !Number.isSafeInteger(next) || next < 0)
+                    throw new RangeError(`${this.name}'s fold ${f} reads more than its items`);
+                value = next;
+                if (value !== 0)
+                    acc.set(i + 1, value);
+            });
+        }
+        return { maps, len: items.length };
+    }
+}
 export class ItemsRef {
     name;
     kind;
@@ -1371,6 +1454,27 @@ export class Rule {
     facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
     // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
+    // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
+    //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
+    carriesList(name, of, folds = {}, lemmas = {}) {
+        const entries = [[name, of, folds, lemmas]];
+        for (const [n, , fs] of entries)
+            for (const f of Object.keys(fs))
+                if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                    throw new Error(`${n}: ${f} is not a plain fold name`);
+        // The folds' lemmas, proven now (a lemma that isn't throws, with the verdict).
+        for (const [n, k, fs, ls] of entries) {
+            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls).prove();
+            if (!(v2.proven && v2.checked))
+                throw new Unproven(`${n}'s fold lemmas`, v2);
+        }
+        for (const [n, , fs] of entries)
+            for (const f of Object.keys(fs))
+                if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                    throw new Error(`${n}: ${f} is not a plain fold name`);
+        const maps = entries.flatMap(([n, k, fs]) => [...k.vars(n), ...Object.keys(fs).map(f => `${n}$${f}`)]);
+        return this.with({ carried: [...(this.spec.carried ?? []), ...maps], inputs: [...this.spec.inputs, ...entries.map(([n]) => [`${n}_len`, nat])], lists2: [...(this.spec.lists2 ?? []), ...entries] });
+    }
     // Named conditions of the step, decided once per step before it; each call's flags may read the earlier calls'. A flag
     // named again replaces the earlier definition in place (what a variant needs: one call, the step unchanged); the new
     // definition may read only the flags defined before the original's place, as the kernel checks.
@@ -1500,6 +1604,8 @@ export class Rule {
     //   r.relate('the secret is irrelevant', (a, b) => a.user.eq(b.user), (a, b) => a.allowed.iff(b.allowed))
     relate(name, given, then) {
         const s = this.spec, b = (n) => `b.${n}`, own = [...s.inputs.map(([n]) => n), ...(s.carried ?? [])];
+        if (s.lists2?.length)
+            throw new Error(`${s.name}: a decision about two requests takes no carried list`);
         const second = (env) => ({ ...env, ...Object.fromEntries(own.map(n => [n, env[b(n)]])) });
         const pair = new Rule({ ...s, inputs: [...s.inputs, ...s.inputs.map(([n, k]) => [b(n), k])], carried: [...(s.carried ?? []), ...(s.carried ?? []).map(b)],
             assume: [...s.assume, ...s.assume.map(f => (env) => f(second(env)))], flags: [], step: undefined, record: undefined, sums: [], queries: [], keep: undefined, relations: undefined, prune: undefined });
@@ -1543,6 +1649,12 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
+                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls);
+                for (const part of l.maps)
+                    delete out[part];
+                out[n] = l;
+            }
         }
         if (parts.state !== false) {
             for (const [n] of this.spec.state)
@@ -1653,7 +1765,7 @@ export class Rule {
                 state[n] = hoist.term(termOf(u));
         }
         const pre = [...this.kindAssumptions('params'), ...s.pre.map(f => f(pEnv).c)];
-        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => hoist.cond(f(env).c))];
+        const assume = [...this.kindAssumptions('inputs'), ...(s.lists2 ?? []).flatMap(([n]) => env[n].equations().map(c => hoist.cond(c.c))), ...s.assume.map(f => hoist.cond(f(env).c))];
         placed();
         // Functions, and their facts: each function's own (named after it), then the rule's.
         // The functions a function reads come first, each named <function>.<use>.
@@ -1865,9 +1977,16 @@ export class Rule {
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
     // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    // A carried list is an array of its items' runtime values (its length and folds computed from them).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     encodeInput(values) {
-        const out = encode(this.spec.inputs, values);
+        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(values[n])]));
+        const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
+        for (const l of Object.values(lists))
+            Object.assign(out, l.maps);
         for (const n of this.spec.carried ?? []) {
+            if (n in out)
+                continue;
             const given = values[n];
             out[n] = given instanceof Map ? new Map(given) : new Map([...given].map(key => [key, 1]));
         }
@@ -1879,6 +1998,11 @@ export class Rule {
         const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
         for (const n of this.spec.carried ?? [])
             out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
+        // A carried list: items drawn by their kind, its length and folds as the encoding computes them.
+        for (const [n, k, fs] of this.spec.lists2 ?? []) {
+            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
+            Object.assign(out, l.maps, { [`${n}_len`]: l.len });
+        }
         return out;
     }
     // The state's scalars as runtime values: each kinded variable as its kind decodes it (an integer as one signed
@@ -2105,3 +2229,112 @@ export function crossCheckDecision(d, opts = {}) {
     return { checked };
 }
 export const proveLoop = (l, laws) => goalsVerdict(loopObligations(l.loop, laws, l.rankTerms));
+export class FoldRule {
+    spec;
+    constructor(spec) {
+        this.spec = spec;
+    }
+    with(more) { return new FoldRule({ ...this.spec, ...more }); }
+    get name() { return this.spec.name; }
+    params(kinds) { return this.with({ params: [...this.spec.params, ...Object.entries(kinds)] }); }
+    inputs(kinds) { return this.with({ inputs: [...this.spec.inputs, ...Object.entries(kinds)] }); }
+    pre(f) { return this.with({ pre: [...this.spec.pre, f] }); }
+    // What every leaf's and node's inputs satisfy (with their kinds' own assumptions).
+    assume(f) { return this.with({ assume: [...this.spec.assume, f] }); }
+    leaf(f) { return this.with({ leaf: f }); }
+    node(f) { return this.with({ node: f }); }
+    env(inputs = true) {
+        const out = {};
+        for (const [n, k] of this.spec.params)
+            out[n] = k.value(n);
+        if (inputs)
+            for (const [n, k] of this.spec.inputs)
+                out[n] = k.value(n);
+        return out;
+    }
+    names() {
+        if (!this.spec.leaf)
+            throw new Error(`${this.spec.name}: a fold needs a leaf`);
+        return Object.keys(this.spec.leaf(this.env()));
+    }
+    side(prefix) { return Object.fromEntries(this.names().map(n => [n, v(`${prefix}${n}`)])); }
+    // A law about the values (and the params): it reads no input.
+    law(name, f) { return { name, holds: f({ ...this.env(false), ...this.side('') }).c }; }
+    get fold() {
+        const s = this.spec;
+        if (!s.leaf || !s.node)
+            throw new Error(`${s.name}: a fold needs a leaf and a node`);
+        const env = this.env(), pEnv = this.env(false);
+        const pre = [...s.params.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.pre.map(f => f(pEnv).c)];
+        const assume = [...s.inputs.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.assume.map(f => f(env).c)];
+        const terms = (r) => Object.fromEntries(Object.entries(r).map(([n, t]) => [n, termOf(t)]));
+        const leaf = terms(s.leaf(env)), node = terms(s.node(env, this.side('l_'), this.side('r_')));
+        return { name: s.name, params: s.params.flatMap(([n, k]) => k.vars(n)), inputs: s.inputs.flatMap(([n, k]) => k.vars(n)), leaf, node,
+            ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}), ...(assume.length ? { assume: assume.length === 1 ? assume[0] : { op: 'and', xs: assume } } : {}) };
+    }
+    // The values of a tree, by the terms that were proven (each leaf's and node's inputs as their kinds encode them; one
+    // that doesn't meet `assume` is refused, as the laws are claimed only of trees that meet it).
+    run(tree, params = {}) {
+        const f = this.fold, ps = encode(this.spec.params, params), none = { name: f.name, params: [], inputs: [], state: {}, step: {} };
+        const st = { scalars: {}, maps: {} };
+        if (f.pre && !evalC(f.pre, ps, st, none))
+            throw new RangeError(`${f.name}: the params don't meet its precondition`);
+        const go = (t) => {
+            const own = 'leaf' in t ? t.leaf : t.node, env = { ...ps, ...encode(this.spec.inputs, own) };
+            if (f.assume && !evalC(f.assume, env, st, none))
+                throw new RangeError(`${f.name}: ${JSON.stringify(own)} doesn't meet its assumption`);
+            if ('leaf' in t)
+                return Object.fromEntries(Object.entries(f.leaf).map(([n, e]) => [n, evalE(e, env, st, none)]));
+            const l = go(t.left), r = go(t.right);
+            const both = { ...env, ...Object.fromEntries(Object.entries(l).map(([n, x]) => [`l_${n}`, x])), ...Object.fromEntries(Object.entries(r).map(([n, x]) => [`r_${n}`, x])) };
+            return Object.fromEntries(Object.entries(f.node).map(([n, e]) => [n, evalE(e, both, st, none)]));
+        };
+        return go(tree);
+    }
+    // The builders against what they built, on random trees: each value by the callbacks' own arithmetic against the
+    // terms the kernel proved (as run evaluates them), and each law's callback against its condition.
+    crossCheck(laws = [], opts = {}) {
+        const s = this.spec, rand = opts.rand ?? seeded(13), bound = opts.bound ?? 6, f = this.fold;
+        let checked = 0;
+        const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
+        const tree = (d) => (d === 0 || rand(3) === 0 ? { leaf: sample(s.inputs) } : { node: sample(s.inputs), left: tree(d - 1), right: tree(d - 1) });
+        const known = (vals) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [n, new Term({ op: 'const', value: x }, x)]));
+        for (let t = 0; t < (opts.trials ?? 200); t++) {
+            const params = sample(s.params), ps = encode(s.params, params);
+            const pv = known(ps), pEnv = Object.fromEntries(s.params.map(([n, k]) => [n, k.build(n, part => pv[part])]));
+            const builder = (tr) => {
+                const own = 'leaf' in tr ? tr.leaf : tr.node, iv = known(encode(s.inputs, own)), env = { ...pEnv, ...Object.fromEntries(s.inputs.map(([n, k]) => [n, k.build(n, part => iv[part])])) };
+                const out = 'leaf' in tr ? s.leaf(env) : (() => { const l = builder(tr.left), r = builder(tr.right); return l && r ? s.node(env, known(l), known(r)) : undefined; })();
+                if (!out)
+                    return undefined;
+                const vals = Object.entries(out).map(([n, x]) => [n, valOf(x)]);
+                return vals.every(([, x]) => x !== undefined) ? Object.fromEntries(vals) : undefined;
+            };
+            const tr = tree(opts.depth ?? 3);
+            let ours;
+            try {
+                ours = this.run(tr, params);
+            }
+            catch {
+                continue;
+            }
+            const theirs = builder(tr);
+            if (!theirs)
+                continue;
+            for (const [n, x] of Object.entries(theirs)) {
+                checked++;
+                if (ours[n] !== x)
+                    return { checked, failure: `${f.name}: ${n} is ${x} by its callbacks, ${ours[n]} by the terms proven, for ${JSON.stringify(tr)}` };
+            }
+            for (const law of laws) {
+                const ok = evalC(law.holds, { ...ps, ...ours }, { scalars: {}, maps: {} }, { name: f.name, params: [], inputs: [], state: {}, step: {} });
+                checked++;
+                if (!ok)
+                    return { checked, failure: `${f.name}: law ${law.name} fails for ${JSON.stringify(tr)} with params ${JSON.stringify(params)}` };
+            }
+        }
+        return { checked };
+    }
+}
+export const fold = (name) => new FoldRule({ name, params: [], inputs: [], pre: [], assume: [] });
+export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, laws));

package/dist/core/solver.d.ts

@@ -39,3 +39,4 @@ export type Verdict = {
     point?: Record<string, number>;
 };
 export declare function solve(constraints: Constraint[], maxRows?: number): Verdict;
+export declare function refuteFast(constraints: Constraint[], maxRows?: number): Verdict | undefined;

package/dist/core/solver.js

@@ -8,18 +8,38 @@
 // exact shadow). Then a rational solution of the rest extends to an integer x, so back-substitution finds a witness.
 export const v = (name) => ({ [name]: 1 });
 export const k = (value) => (value === 0 ? {} : { 1: value });
+// (Plain loops, no intermediate arrays: these run millions of times in a proof. Each keeps the keys in the order they
+// first appear, as a sum over the entries would.)
 export function add(...xs) {
     const out = {};
     for (const x of xs)
-        for (const [key, value] of Object.entries(x))
-            out[key] = (out[key] ?? 0) + value;
-    for (const key of Object.keys(out))
+        for (const key in x)
+            out[key] = (out[key] ?? 0) + x[key];
+    for (const key in out)
         if (out[key] === 0)
             delete out[key];
     return out;
 }
-export const scale = (x, f) => add(Object.fromEntries(Object.entries(x).map(([key, value]) => [key, value * f])));
-export const sub = (a, b) => add(a, scale(b, -1));
+export const scale = (x, f) => {
+    const out = {};
+    for (const key in x) {
+        const value = x[key] * f;
+        if (value !== 0)
+            out[key] = value;
+    }
+    return out;
+};
+export const sub = (a, b) => {
+    const out = {};
+    for (const key in a)
+        out[key] = a[key];
+    for (const key in b)
+        out[key] = (out[key] ?? 0) - b[key];
+    for (const key in out)
+        if (out[key] === 0)
+            delete out[key];
+    return out;
+};
 export function show(x) {
     const parts = Object.entries(x).filter(([key]) => key !== '1').map(([key, c]) => (c === 1 ? key : c === -1 ? `-${key}` : `${c}${key}`));
     if ((x['1'] ?? 0) !== 0 || parts.length === 0)
@@ -180,3 +200,94 @@ function prune(steps, last) {
         return s.kind === 'combine' ? { ...s, a: at.get(s.a), b: at.get(s.b) } : s.kind === 'cut' ? { ...s, of: at.get(s.of) } : s;
     });
 }
+// A refutation found fast, where there is one over the rationals: Farkas' lemma says rows a·x + c <= 0 (x free) have no
+// rational solution exactly when some λ >= 0 has Σ λ·a = 0 and Σ λ·c > 0. A floating-point simplex looks for such λ
+// (phase one on Σ λ·a = 0, Σ λ·c = 1), and elimination on the rows it uses alone (usually a handful) gives the
+// derivation, renumbered to the whole system's rows. Floating point only picks the rows: the derivation is exact, and
+// the checker sees nothing else. Undefined when no λ turns up (a system with a rational solution, or one the floats
+// misjudge): the caller goes on as without it.
+export function refuteFast(constraints, maxRows = 2_000) {
+    const m = constraints.length;
+    if (m === 0)
+        return undefined;
+    const names = [...new Set(constraints.flatMap(c => vars(c.lin)))], n = names.length;
+    if (m > maxRows || n > maxRows)
+        return undefined;
+    // Tableau rows: one per variable (Σ λ_i a_ij = 0) and the normalization (Σ λ_i c_i = 1); columns: the m λs, then one
+    // artificial per row, then the right-hand side.
+    const R = n + 1, cols = m + R;
+    const T = Array.from({ length: R }, () => new Float64Array(cols + 1));
+    const col = new Map(names.map((x, j) => [x, j]));
+    constraints.forEach((c, i) => {
+        for (const [key, a] of Object.entries(c.lin)) {
+            if (key === '1')
+                T[n][i] = a;
+            else
+                T[col.get(key)][i] = a;
+        }
+    });
+    T[n][cols] = 1;
+    for (let r = 0; r < R; r++)
+        T[r][m + r] = 1;
+    const basis = Array.from({ length: R }, (_, r) => m + r);
+    // Phase one: minimize the artificials' sum, as the reduced costs of the objective row.
+    const z = new Float64Array(cols + 1);
+    for (let r = 0; r < R; r++)
+        for (let j = 0; j <= cols; j++)
+            if (j < m || j === cols)
+                z[j] -= T[r][j];
+    const eps = 1e-9;
+    for (let iter = 0; iter < 50 * (R + m); iter++) {
+        // Bland's rule: the first column with a negative reduced cost enters (no cycling on degenerate systems).
+        let enter = -1;
+        for (let j = 0; j < cols; j++)
+            if (z[j] < -eps) {
+                enter = j;
+                break;
+            }
+        if (enter < 0)
+            break;
+        let leave = -1, best = Infinity;
+        for (let r = 0; r < R; r++) {
+            const a = T[r][enter];
+            if (a > eps) {
+                const ratio = T[r][cols] / a;
+                if (ratio < best - eps || (Math.abs(ratio - best) <= eps && basis[r] < basis[leave])) {
+                    best = ratio;
+                    leave = r;
+                }
+            }
+        }
+        if (leave < 0)
+            return undefined; // unbounded: cannot happen in phase one; give up rather than guess
+        const p = T[leave], pv = p[enter];
+        for (let j = 0; j <= cols; j++)
+            p[j] /= pv;
+        for (let r = 0; r < R; r++)
+            if (r !== leave) {
+                const f = T[r][enter];
+                if (f !== 0) {
+                    const row = T[r];
+                    for (let j = 0; j <= cols; j++)
+                        row[j] -= f * p[j];
+                }
+            }
+        const f = z[enter];
+        if (f !== 0)
+            for (let j = 0; j <= cols; j++)
+                z[j] -= f * p[j];
+        basis[leave] = enter;
+    }
+    if (-z[cols] > 1e-7)
+        return undefined; // the artificials can't all leave: no λ, so a rational solution exists
+    const support = [];
+    for (let r = 0; r < R; r++)
+        if (basis[r] < m && T[r][cols] > eps)
+            support.push(basis[r]);
+    if (!support.length)
+        return undefined;
+    const sub = solve(support.sort((a, b) => a - b).map(i => constraints[i]));
+    if (sub.kind !== 'refuted')
+        return undefined;
+    return { kind: 'refuted', steps: sub.steps.map(st => (st.kind === 'input' ? { ...st, index: support[st.index] } : st)) };
+}

package/dist/kernel/kernel.d.ts

@@ -18,6 +18,7 @@ export type Path = Map<string, {
     holds: boolean;
 }>;
 export declare const canon: (lin: Lin) => string;
+export declare const canonFlip: (lin: Lin) => string;
 export declare const atomOf: (lin: Lin, holds: boolean) => Constraint;
 export declare function linear(e: E, path: Path): Lin | undefined;
 export declare const termColumn: (e: E) => string;
@@ -27,6 +28,12 @@ export declare function termRows(name: string, path: Path): Lin[];
 export declare function truth(c: C, path: Path): boolean | undefined;
 export declare function facts(c: C, path: Path, positive?: boolean): Lin[];
 export declare function leafConstraints(goal: Goal, path: Path): Constraint[];
+export declare function leafConstraintsReusing(goal: Goal, path: Path): Constraint[];
+type Seen<T> = {
+    reads: [string, boolean | undefined][];
+    out: T;
+}[];
+export declare function reusing<T>(seen: Seen<T>, path: Path, f: (path: Path) => T): T;
 export declare function withProducts(rows: Constraint[], pairs: [number, number][]): Constraint[];
 export declare function check(goal: Goal, tree: Tree, path?: Path): boolean;
 export type Subst = {
@@ -46,7 +53,7 @@ export declare function historyMachine(m: Machine): {
     machine: Machine;
     goals: Goal[];
 };
-export declare function obligations(m: Machine, laws: Law[], instances?: Record<string, Instances>): Goal[];
+export declare function obligations(m: Machine, laws: Law[], instances?: Record<string, Instances>, only?: number): Goal[];
 export declare function checkLaws(m: Machine, laws: Law[], proof: {
     instances: Record<string, Instances>;
     trees: Record<string, Tree>;
@@ -122,3 +129,4 @@ export type Fold = {
     assume?: C;
 };
 export declare function foldObligations(f: Fold, laws: Law[]): Goal[];
+export {};

package/dist/kernel/kernel.js

@@ -22,25 +22,99 @@ import { add, k, scale, sub, v } from "../core/solver.js";
 // An exhaustive switch's default: TypeScript proves it unreachable, and if it is reached anyway (a value from outside
 // the types), it fails loudly instead of returning undefined.
 export function unreachable(value) { throw new Error(`unhandled case: ${JSON.stringify(value)}`); }
-export const canon = (lin) => Object.keys(lin).sort().map(key => `${key}:${lin[key]}`).join(',');
+// (Remembered per linear form: a form is never changed once built, and the same forms are looked up at every node.)
+const canonMemo = new WeakMap(), flipMemo = new WeakMap();
+export const canon = (lin) => {
+    let out = canonMemo.get(lin);
+    if (out === undefined)
+        canonMemo.set(lin, (out = Object.keys(lin).sort().map(key => `${key}:${lin[key]}`).join(',')));
+    return out;
+};
+// canon(1 − lin), the atom that decides lin <= 0 the other way, without building it.
+export const canonFlip = (lin) => {
+    let out = flipMemo.get(lin);
+    if (out !== undefined)
+        return out;
+    const keys = Object.keys(lin);
+    if (!('1' in lin))
+        keys.push('1');
+    const parts = [];
+    for (const key of keys.sort()) {
+        const c = key === '1' ? 1 - (lin['1'] ?? 0) : -lin[key];
+        if (c !== 0)
+            parts.push(`${key}:${c}`);
+    }
+    flipMemo.set(lin, (out = parts.join(',')));
+    return out;
+};
 export const atomOf = (lin, holds) => ({ lin: holds ? lin : add(k(1), scale(lin, -1)), label: '' });
 // Is lin <= 0 decided by the path? A constant atom decides itself.
 // Over the integers lin <= 0 fails exactly when 1 - lin <= 0 holds, so either atom decides the other.
 function decide(lin, path) {
-    if (Object.keys(lin).every(key => key === '1'))
+    let constant = true;
+    for (const key in lin)
+        if (key !== '1') {
+            constant = false;
+            break;
+        }
+    if (constant)
         return (lin['1'] ?? 0) <= 0;
-    const direct = path.get(canon(lin))?.holds;
+    const direct = look(path, canon(lin));
     if (direct !== undefined)
         return direct;
-    const flipped = path.get(canon(add(k(1), scale(lin, -1))))?.holds;
+    const flipped = look(path, canonFlip(lin));
     return flipped === undefined ? undefined : !flipped;
 }
+// Every decision a hypothesis' facts read, found or not, while they are recorded (leafConstraintsReusing).
+let recording;
+const look = (path, key) => { const out = path.get(key)?.holds; if (recording)
+    recording.set(key, out); return out; };
 // A term's linear form under the path. Reads become cells, named by map and key: `M[key]`; a choice the path leaves
 // open (∸, min, max, if) becomes a column of its own, `⟦n⟧`, standing for the term's value (see termRows).
 // Remembered per path and term (a path is never changed once built; a new decision is a new path), so a term shared
 // across hypotheses, or nested in a k-step run's later states, is read once per path.
+// A term without a choice (no ∸, min, max or if inside, its keys' too) reads alike on every path: remembered once.
 const linearMemo = new WeakMap();
+const freeMemo = new WeakMap(), freeLinear = new WeakMap();
+const choiceFree = (e) => {
+    let out = freeMemo.get(e);
+    if (out !== undefined)
+        return out;
+    switch (e.op) {
+        case 'var':
+        case 'const':
+            out = true;
+            break;
+        case 'mul':
+            out = choiceFree(e.a);
+            break;
+        case 'get':
+            out = choiceFree(e.key);
+            break;
+        case 'add':
+        case 'prod':
+            out = choiceFree(e.a) && choiceFree(e.b);
+            break;
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'if':
+            out = false;
+            break;
+    }
+    freeMemo.set(e, out);
+    return out;
+};
 export function linear(e, path) {
+    if (choiceFree(e)) {
+        if (freeLinear.has(e))
+            return freeLinear.get(e);
+        const out = linearOf(e, path);
+        freeLinear.set(e, out);
+        return out;
+    }
+    if (reuse)
+        return reusing(seenOf(linearSeen, e), path, p => linearOf(e, p));
     let memo = linearMemo.get(path);
     if (!memo)
         linearMemo.set(path, (memo = new WeakMap()));
@@ -158,8 +232,28 @@ function times(a, b) {
         }
     return add(...out);
 }
-// The atoms (lin <= 0 each) that make a comparison true, and those that make it false (one of which holds).
+const comparisonMemo = new WeakMap(), freeComparison = new WeakMap();
 function comparison(c, path) {
+    const free = choiceFree(c.a) && choiceFree(c.b);
+    if (free && freeComparison.has(c))
+        return freeComparison.get(c);
+    if (!free && reuse)
+        return reusing(seenOf(comparisonSeen, c), path, p => comparisonOf(c, p));
+    let memo = comparisonMemo.get(path);
+    if (!free) {
+        if (!memo)
+            comparisonMemo.set(path, (memo = new WeakMap()));
+        if (memo.has(c))
+            return memo.get(c);
+    }
+    const out = comparisonOf(c, path);
+    if (free)
+        freeComparison.set(c, out);
+    else
+        memo.set(c, out);
+    return out;
+}
+function comparisonOf(c, path) {
     const a = linear(c.a, path), b = linear(c.b, path);
     if (!a || !b)
         return undefined;
@@ -170,8 +264,21 @@ function comparison(c, path) {
         return { when: [add(ab, k(1))], unless: [[ba]] };
     return { when: [ab, ba], unless: [[add(ab, k(1))], [add(ba, k(1))]] };
 }
-// Kleene truth under the path: true, false, or undefined when open.
+// Kleene truth under the path: true, false, or undefined when open (remembered per path and condition).
+const truthMemo = new WeakMap();
 export function truth(c, path) {
+    if (reuse)
+        return reusing(seenOf(truthSeen, c), path, p => truthOf(c, p));
+    let memo = truthMemo.get(path);
+    if (!memo)
+        truthMemo.set(path, (memo = new WeakMap()));
+    if (memo.has(c))
+        return memo.get(c);
+    const out = truthOf(c, path);
+    memo.set(c, out);
+    return out;
+}
+function truthOf(c, path) {
     switch (c.op) {
         case 'flag': throw new Error('flags are inlined before the kernel sees them');
         case 'all': return undefined; // closed before a goal is checked; opaque here, so it gives a leaf nothing
@@ -224,10 +331,57 @@ export function facts(c, path, positive = true) {
     }
 }
 // What a leaf's derivation must refute.
-export function leafConstraints(goal, path) {
+export function leafConstraints(goal, path) { return leafRows(goal, path, h => facts(h, path)); }
+const factsSeen = new WeakMap();
+export function leafConstraintsReusing(goal, path) {
+    let byHyp = factsSeen.get(goal);
+    if (!byHyp)
+        factsSeen.set(goal, (byHyp = new Map()));
+    return leafRows(goal, path, h => {
+        let seen = byHyp.get(h);
+        if (!seen)
+            byHyp.set(h, (seen = []));
+        return reusing(seen, path, p => facts(h, p));
+    });
+}
+export function reusing(seen, path, f) {
+    const hit = seen.find(e => e.reads.every(([key, holds]) => path.get(key)?.holds === holds));
+    if (hit) {
+        if (recording)
+            for (const [key, holds] of hit.reads)
+                recording.set(key, holds);
+        return hit.out;
+    }
+    const outer = recording, mode = reuse;
+    recording = new Map();
+    reuse = true;
+    try {
+        const out = f(new Map(path));
+        seen.unshift({ reads: [...recording], out });
+        if (seen.length > 16)
+            seen.pop();
+        return out;
+    }
+    finally {
+        // What was read inside is read by the outer value too.
+        if (outer)
+            for (const [key, holds] of recording)
+                outer.set(key, holds);
+        recording = outer;
+        reuse = mode;
+    }
+}
+// While the prover reuses (inside `reusing`), a term's linear form, a comparison and a condition's truth are reused the
+// same way, each by the decisions it reads: only what a new decision touches is read again. The kernel's check never
+// runs in this mode: it reads every term afresh on every path.
+let reuse = false;
+const linearSeen = new WeakMap(), comparisonSeen = new WeakMap(), truthSeen = new WeakMap();
+const seenOf = (m, k) => { let s = m.get(k); if (!s)
+    m.set(k, (s = [])); return s; };
+function leafRows(goal, path, factsOf) {
     const rows = [...path.values()].map(a => atomOf(a.lin, a.holds));
     for (const h of goal.hyps)
-        for (const lin of facts(h, path))
+        for (const lin of factsOf(h))
             rows.push({ lin, label: '' });
     const names = new Set(rows.flatMap(r => Object.keys(r.lin).filter(key => key !== '1')));
     // Two reads of one map whose keys the path proves equal are equal.
@@ -755,10 +909,11 @@ export function historyMachine(m) {
     }
     return { machine, goals };
 }
-export function obligations(m, laws, instances = {}) {
+// `only`: the goals of that law alone (the prover's instance search asks for one law's at a time).
+export function obligations(m, laws, instances = {}, only) {
     if (m.history) {
         const { machine, goals } = historyMachine(m);
-        return [...obligations(machine, laws, instances), ...goals];
+        return [...obligations(machine, laws, instances, only), ...(only === undefined ? goals : [])];
     }
     scope(m, laws);
     const ok = [...Object.values(m.state), ...Object.values(m.step.state ?? {}), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.value] : [w.key, w.value]))].every(natural)
@@ -770,7 +925,9 @@ export function obligations(m, laws, instances = {}) {
     // value of it too (the Lean twin reads it so).
     const proven = (law) => (law.forall ? substC(law.holds, { vars: { [law.forall]: { op: 'var', name: `${law.forall}#` } }, maps: {}, flags: {} }) : law.holds);
     const pre = preOf(m), u = updateOf(m), assume = m.assume ? [inlineFlags(m, m.assume)] : [];
-    return laws.flatMap(law => {
+    return laws.flatMap((law, i) => {
+        if (only !== undefined && i !== only)
+            return [];
         // At the start: the precondition, and no request. One step: from a state where the laws hold, a request allowed.
         // The facts hold throughout, read where the run begins (they read no state).
         const start = given(m, holds(from(startOf(m)), pre), instances[law.name] ?? {});

package/dist/kernel/prove.d.ts

@@ -1,5 +1,26 @@
 import type { C, E, Law, Machine } from '../core/machine.js';
 import { type Goal, type Instances, type Liveness, type Path, type StepLaw, type Tree } from './kernel.js';
+export declare const profile: {
+    on: boolean;
+    goals: {
+        name: string;
+        ms: number;
+        nodes: number;
+        solves: number;
+        solveMs: number;
+        rowsMs: number;
+        proven: boolean;
+    }[];
+    solves: number;
+    solveMs: number;
+    rowsMs: number;
+    nodes: number;
+};
+export declare const solveKinds: Record<string, {
+    n: number;
+    ms: number;
+    rows: number;
+}>;
 export type Outcome = {
     tree: Tree;
     nodes: number;

package/dist/kernel/prove.js

@@ -1,5 +1,5 @@
-import { add, k, scale, solve, sub, v } from "../core/solver.js";
-import { assumed, canon, columnTerm, decided, stepZone, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
+import { add, k, refuteFast, scale, solve, sub, v } from "../core/solver.js";
+import { assumed, canon, canonFlip, columnTerm, decided, stepZone, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, leafConstraintsReusing, reusing, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
 // The atoms the path leaves open, in evaluation order: deciding any of them makes progress.
 function openE(e, path, out) {
     switch (e.op) {
@@ -38,17 +38,18 @@ function openC(c, path, out) {
         return openC(c.x, path, out);
     if (c.op === 'and' || c.op === 'or')
         return c.xs.forEach(y => openC(y, path, out));
-    openE(c.a, path, out), openE(c.b, path, out);
-    const a = linear(c.a, path), b = linear(c.b, path);
+    const a = linear(c.a, path), b = linear(c.b, path), own = [];
     if (a && b) {
         const d = sub(a, b);
         if (c.op === '<=')
-            out.push(d);
+            own.push(d);
         else if (c.op === '<')
-            out.push(add(d, k(1)));
+            own.push(add(d, k(1)));
         else
-            out.push(d, scale(d, -1));
+            own.push(d, scale(d, -1));
     }
+    openE(c.a, path, out), openE(c.b, path, out);
+    out.push(...own);
 }
 // A hypothesis is settled when it gives facts that are all its content: here, when its truth is decided, or it is a
 // conjunction of settled parts / a linear comparison. A disjunction is settled only once one disjunct is left open and
@@ -85,7 +86,7 @@ function openCells(rows, path) {
             if (p.slice(0, p.indexOf('[')) !== q.slice(0, q.indexOf('[')))
                 continue;
             const d = sub(parse(keyText(p)), parse(keyText(q)));
-            const dec = (lin) => path.get(canon(lin))?.holds ?? (path.has(canon(add(k(1), scale(lin, -1)))) ? !path.get(canon(add(k(1), scale(lin, -1)))).holds : undefined);
+            const dec = (lin) => path.get(canon(lin))?.holds ?? (path.has(canonFlip(lin)) ? !path.get(canonFlip(lin)).holds : undefined);
             const a = dec(d), b = dec(scale(d, -1));
             if (a === undefined)
                 out.push(d);
@@ -113,9 +114,40 @@ function parse(text) {
     }
     return out;
 }
+// Where a goal's time goes, when asked (research/perf/prover-bench.ts): each root goal's time, nodes, solver calls and
+// the time in the solver and in building rows. Off unless `profile.on`; the counters cost nothing then.
+export const profile = { on: false, goals: [], solves: 0, solveMs: 0, rowsMs: 0, nodes: 0 };
+const timed = (f, add) => { if (!profile.on)
+    return f(); const t = performance.now(); try {
+    return f();
+}
+finally {
+    add(performance.now() - t);
+} };
+export const solveKinds = {};
+const solveP = (rows, maxRows) => {
+    if (!profile.on)
+        return solve(rows, maxRows);
+    const t = performance.now(), out = solve(rows, maxRows), ms = performance.now() - t;
+    profile.solves++;
+    profile.solveMs += ms;
+    const s = (solveKinds[out.kind] ??= { n: 0, ms: 0, rows: 0 });
+    s.n++;
+    s.ms += ms;
+    s.rows += rows.length;
+    return out;
+};
 // The budget: 200,000 nodes and, by default, a second per hypothesis (at least 20 seconds) per goal; past either the goal
 // is left `unknown`. A goal with many instances (a law about two keys at its pairs) has that many more rows per leaf.
 export function grow(goal, path = new Map(), budget = { nodes: 0, until: performance.now() + Math.max(20_000, 1_000 * goal.hyps.length) }) {
+    if (!profile.on || path.size || budget.nodes)
+        return growRoot(goal, path, budget);
+    const t = performance.now(), s0 = profile.solves, m0 = profile.solveMs, r0 = profile.rowsMs, n0 = profile.nodes;
+    const out = growRoot(goal, path, budget);
+    profile.goals.push({ name: goal.name, ms: performance.now() - t, nodes: profile.nodes - n0, solves: profile.solves - s0, solveMs: profile.solveMs - m0, rowsMs: profile.rowsMs - r0, proven: 'tree' in out });
+    return out;
+}
+function growRoot(goal, path, budget) {
     // At the root: plainly first; where the cases multiply past a budget, through cuts. The plain budget halves with each
     // two open choices (what a plain search's cases grow by), so a long run's steps reach the cuts early.
     if (path.size === 0 && budget.nodes === 0) {
@@ -132,24 +164,47 @@ export function grow(goal, path = new Map(), budget = { nodes: 0, until: perform
 function growPlain(goal, path, budget) {
     if (budget.cap !== undefined && budget.nodes >= budget.cap)
         return { stuck: 'unknown', path, why: 'cap' };
+    if (profile.on)
+        profile.nodes++;
     if (++budget.nodes > 200_000 || (budget.until !== undefined && performance.now() > budget.until))
         return { stuck: 'unknown', path, why: outOfBudget(goal, budget.nodes > 200_000 ? 'nodes' : 'time', path.size) };
     // Rows that read a term column only once a cut has put one on the path; before, the rows a choice-free search uses
     // (what it saw before term columns), renumbered to the whole leaf's when a leaf is found.
-    const full = leafConstraints(goal, path);
+    const full = timed(() => leafConstraintsReusing(goal, path), ms => { profile.rowsMs += ms; });
     const columns = [...path.values()].some(a => Object.keys(a.lin).some(key => key.startsWith('⟦')));
     const idx = full.flatMap((r, i) => (columns || !Object.keys(r.lin).some(key => key.startsWith('⟦')) ? [i] : []));
     const rows = idx.map(i => full[i]), at = (i) => (i < rows.length ? idx[i] : full.length + i - rows.length);
     const leafOf = (steps, products) => ({ leaf: steps.map(st => (st.kind === 'input' ? { ...st, index: at(st.index) } : st)), ...(products ? { products: products.map(([i, j]) => [at(i), at(j)]) } : {}) });
-    const verdict = solve(rows);
-    if (verdict.kind === 'refuted')
-        return { tree: leafOf(verdict.steps), nodes: budget.nodes };
+    // The conclusion's own atoms first (the goal's last hypothesis is the law refuted): a case it doesn't read is often
+    // one no refutation needs, and splitting it first multiplies every case after it.
     const open = [];
-    for (const h of goal.hyps)
-        openH(h, path, open);
+    const hyps = goal.hyps, last = hyps.length - 1;
+    let byHyp = openSeen.get(goal);
+    if (!byHyp)
+        openSeen.set(goal, (byHyp = new Map()));
+    const openOf = (h) => { let seen = byHyp.get(h); if (!seen)
+        byHyp.set(h, (seen = [])); return reusing(seen, path, p => { const out = []; openH(h, p, out); return out; }); };
+    if (last >= 0)
+        open.push(...openOf(hyps[last]));
+    for (const [i, h] of hyps.entries())
+        if (i !== last)
+            open.push(...openOf(h));
     open.push(...openCells(rows, path));
-    let split = open.find(lin => Object.keys(lin).some(key => key !== '1') && !path.has(canon(lin)) && !path.has(canon(add(k(1), scale(lin, -1)))))
-        ?? (verdict.kind === 'unknown' ? bisect(rows, path) ?? fractional(verdict.point, path) : undefined);
+    const next = open.find(lin => Object.keys(lin).some(key => key !== '1') && !path.has(canon(lin)) && !path.has(canonFlip(lin)));
+    // With a case still to split, only "refuted or not" matters (a witness here goes unused): a large system is tried by
+    // its Farkas rows alone, and left to the split if they don't refute it. Elimination to the last variable, which a
+    // satisfiable system needs to say so, is kept for small systems and for the leaves, where its answer is the outcome.
+    // Past the Farkas rows, elimination still runs, bounded (a refutation the rationals miss is an integer one, which
+    // elimination's cuts find early; a satisfiable system grows past the bound and is left to the split).
+    if (next && rows.length > 60) {
+        const fast = timed(() => refuteFast(rows), ms => { profile.solves++; profile.solveMs += ms; });
+        if (fast?.kind === 'refuted')
+            return { tree: leafOf(fast.steps), nodes: budget.nodes };
+    }
+    const verdict = next && rows.length > 60 ? solveP(rows, 2 * rows.length) : solveP(rows);
+    if (verdict.kind === 'refuted')
+        return { tree: leafOf(verdict.steps), nodes: budget.nodes };
+    let split = next ?? (verdict.kind === 'unknown' ? bisect(rows, path) ?? fractional(verdict.point, path) : undefined);
     // Products: with monomials about, try every pair of rows multiplied; failing that, split a factor at zero.
     const monomials = rows.some(r => Object.keys(r.lin).some(key => key.includes('*')));
     // A witness that multiplies out (each monomial's value is its factors' product) is a real model: nothing to refute.
@@ -184,7 +239,7 @@ function growPlain(goal, path, budget) {
                 return { tree: leafOf(third.steps, [...sq, ...cubes]), nodes: budget.nodes };
         }
         const factors = [...new Set(rows.flatMap(r => Object.keys(r.lin).filter(key => key.includes('*')).flatMap(key => key.split('*'))))];
-        const fresh = (lin) => !path.has(canon(lin)) && !path.has(canon(add(k(1), scale(lin, -1))));
+        const fresh = (lin) => !path.has(canon(lin)) && !path.has(canonFlip(lin));
         // Split a factor at zero, else two factors against each other (so (x - y)² >= 0 becomes a product of rows).
         const zero = factors.find(f => fresh({ [f]: 1 }));
         const apart = factors.flatMap((f, i) => factors.slice(i + 1).map(g => ({ [f]: 1, [g]: -1 }))).find(fresh);
@@ -199,11 +254,62 @@ function growPlain(goal, path, budget) {
     const yes = growPlain(goal, new Map(path).set(id, { lin: split, holds: true }), budget);
     if (!('tree' in yes))
         return yes;
+    // A refutation of the yes side that never reads the split refutes the case as it stands: the other side is skipped.
+    const lifted = lift(goal, yes.tree, new Map(path).set(id, { lin: split, holds: true }), path);
+    if (lifted)
+        return { tree: lifted, nodes: budget.nodes };
     const no = growPlain(goal, new Map(path).set(id, { lin: split, holds: false }), budget);
     if (!('tree' in no))
         return no;
     return { tree: { split, yes: yes.tree, no: no.tree }, nodes: budget.nodes };
 }
+// A tree found under one more decision (`from`, the path with it) as a tree under the path without it (`to`), if no
+// leaf reads the decision: each leaf's rows found again among the rows the shorter path gives (the same rows, renumbered:
+// the decision's own row, and any row only it makes, are not there), every split kept. The derivations are the same
+// arithmetic over the same rows, and the kernel checks the whole tree in the end. Undefined at the first leaf that
+// needs the decision.
+function lift(goal, tree, from, to) {
+    const own = to.size; // the decision's row: the last of `from`'s path rows, below every later split's
+    const reads = (t) => ('leaf' in t ? t.leaf.some(st => st.kind === 'input' && st.index === own) || (t.products ?? []).some(([i, j]) => i === own || j === own) : reads(t.yes) || reads(t.no));
+    if (reads(tree))
+        return undefined;
+    const go = (t, a, b) => {
+        if (!('leaf' in t)) {
+            const sid = canon(t.split);
+            if (b.has(sid) || b.has(canonFlip(t.split)))
+                return undefined;
+            const yes = go(t.yes, new Map(a).set(sid, { lin: t.split, holds: true }), new Map(b).set(sid, { lin: t.split, holds: true }));
+            const no = yes && go(t.no, new Map(a).set(sid, { lin: t.split, holds: false }), new Map(b).set(sid, { lin: t.split, holds: false }));
+            return yes && no ? { split: t.split, yes, no } : undefined;
+        }
+        const ra = leafConstraintsReusing(goal, a), rb = leafConstraintsReusing(goal, b), at = new Map();
+        rb.forEach((r, i) => { const key = canon(r.lin); if (!at.has(key))
+            at.set(key, i); });
+        const map = (i) => (i < ra.length ? at.get(canon(ra[i].lin)) : undefined);
+        const leaf = [];
+        for (const st of t.leaf) {
+            if (st.kind !== 'input') {
+                leaf.push(st);
+                continue;
+            }
+            const j = map(st.index);
+            if (j === undefined)
+                return undefined;
+            leaf.push({ ...st, index: j });
+        }
+        const products = [];
+        for (const [i, j] of t.products ?? []) {
+            const pi = map(i), pj = map(j);
+            if (pi === undefined || pj === undefined)
+                return undefined;
+            products.push([pi, pj]);
+        }
+        return { leaf, ...(t.products ? { products } : {}) };
+    };
+    return go(tree, from, to);
+}
+// Each hypothesis' open atoms, as at an earlier path that decided the same atoms it reads (kernel.ts's reusing).
+const openSeen = new WeakMap();
 // What ran out, for a goal left unknown: its size, how deep the case splits went, and the two shapes that usually cause it.
 function outOfBudget(goal, limit, depth) {
     const steps = Number(/@(\d+) steps/.exec(goal.name)?.[1] ?? 1);
@@ -259,7 +365,7 @@ function topAtoms(c, path) {
     if (!a || !b)
         return [];
     const atoms = c.op === '<=' ? [sub(a, b)] : c.op === '<' ? [add(sub(a, b), k(1))] : [sub(a, b), sub(b, a)];
-    return atoms.filter(l => Object.keys(l).some(key => key !== '1') && !path.has(canon(l)) && !path.has(canon(add(k(1), scale(l, -1)))));
+    return atoms.filter(l => Object.keys(l).some(key => key !== '1') && !path.has(canon(l)) && !path.has(canonFlip(l)));
 }
 // A refutation that splits only on these atoms (a cut's failing side), within a small budget.
 function growFocused(goal, path, focus, budget, near = focus) {
@@ -268,7 +374,7 @@ function growFocused(goal, path, focus, budget, near = focus) {
     const verdict = solveNear(leafConstraints(goal, path), [...near, ...[...path.values()].slice(-1).map(a => a.lin)]);
     if (verdict.kind === 'refuted')
         return { tree: { leaf: verdict.steps }, nodes: budget.nodes };
-    const split = focus.find(l => !path.has(canon(l)) && !path.has(canon(add(k(1), scale(l, -1)))));
+    const split = focus.find(l => !path.has(canon(l)) && !path.has(canonFlip(l)));
     if (!split)
         return { stuck: verdict.kind === 'sat' ? 'sat' : 'unknown', path };
     const id = canon(split);
@@ -319,7 +425,7 @@ function bisect(rows, path) {
         const mid = Math.floor((lo + hi) / 2);
         for (const c of lo === hi ? [lo, lo - 1] : [mid]) {
             const lin = c === 0 ? { [x]: 1 } : { [x]: 1, 1: -c };
-            if (!path.has(canon(lin)) && !path.has(canon(add(k(1), scale(lin, -1)))))
+            if (!path.has(canon(lin)) && !path.has(canonFlip(lin)))
                 return lin;
         }
     }
@@ -331,7 +437,7 @@ function fractional(point, path) {
         if (Math.abs(value - Math.round(value)) < 1e-9 || x.includes('*'))
             continue;
         const c = Math.floor(value), lin = c === 0 ? { [x]: 1 } : { [x]: 1, 1: -c };
-        if (!path.has(canon(lin)) && !path.has(canon(add(k(1), scale(lin, -1)))))
+        if (!path.has(canon(lin)) && !path.has(canonFlip(lin)))
             return lin;
     }
     return undefined;
@@ -616,7 +722,7 @@ function proveLawsAsGiven(m, laws) {
     // Each law's two goals (start and step) get their own instances, seeded with its own keys.
     const keys = [...readKeys(m, laws), ...witnesses(m)], instances = {};
     laws.forEach((law, i) => {
-        instances[law.name] = instancesFor(m, laws, inst => obligations(m, laws, { ...instances, [law.name]: inst }).slice(2 * i, 2 * i + 2), {
+        instances[law.name] = instancesFor(m, laws, inst => obligations(m, laws, { ...instances, [law.name]: inst }, i), {
             seed: [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : []), ...(law.keys ?? []).map((name) => ({ op: 'var', name }))],
             focus: [...(law.forall ? [`${law.forall}#`] : []), ...(law.keys ?? [])],
         });

package/dist/lean-kernel/emit.d.ts

@@ -135,6 +135,10 @@ export type LeanItem = {
     loop: Loop;
     rank: E | E[];
     laws?: Law[];
+} | {
+    id: string;
+    fold: Fold;
+    laws: Law[];
 } | {
     id: string;
     goal: Goal;

package/dist/lean-kernel/emit.js

@@ -105,12 +105,19 @@ export function encode(ex, tamper = false, dropStep = true, globalVars, globalMa
                 else if (key.includes('*'))
                     monos.add(key);
             }
+        // Each cell a hypothesis reads under the path, kept or not: two reads of one cell cancel in a row (T − T), yet
+        // Lean's linear form of each still needs the cell's column to see the comparison decided.
         for (const h of goal.hyps)
-            for (const e of subterms(h))
+            for (const e of subterms(h)) {
                 if (e.op === 'prod')
                     for (const key of Object.keys(linear(e, path) ?? {}))
                         if (key.includes('*'))
                             monos.add(key);
+                if (e.op === 'get')
+                    for (const key of Object.keys(linear(e, path) ?? {}))
+                        if (key.includes('['))
+                            addCell(key);
+            }
     });
     const depth = (name) => name.split('[').length;
     // Term columns (open choices, each standing for its term's value) before the cells, whose keys may read them.
@@ -1055,6 +1062,10 @@ export function toLean(items, opts = {}) {
             parts.push(`-- ${item.id}\n${loopToLean(id, item.loop, item.laws ?? [], item.rank)}`);
             theorems.push(`${id}_halts`);
         }
+        else if ('fold' in item) {
+            parts.push(`-- ${item.id}\n${foldToLean(id, item.fold, item.laws)}`);
+            theorems.push(`${id}_laws`);
+        }
         else {
             // goalToLean names its theorem t<i>; here it is the item's id.
             const n = goals++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "An automatic prover for stateful rules (budgets, caps, windows, workflows, policies): laws proven with no proof to write, checked again in Lean, counterexamples found on the GPU, the rule shipped as code",
   "keywords": [
     "verification",
@@ -89,7 +89,7 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "smoke": "sh scripts/smoke.sh",
-    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
+    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts invoices.test.ts folds.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
   },
   "devDependencies": {
     "@gdp-ts/core": "0.1.0",