kibi-core 0.24.0 → 0.27.0

package/src/code_certificates.pl

@@ -19,6 +19,22 @@
 %               plus the negated claim admit no value.
 %   smt         The query asks (check-sat) and the solver answered unsat.
 %               (Kibi re-runs the solver on the query at ingest.)
+%   rule        Every domain lists distinct values, every predicate table
+%               holds exactly one boolean for every combination of its
+%               argument domains, and no call failed.  (Kibi recomputes the
+%               domains and tables from the code at ingest.)
+%   state_machine
+%               The machine lists distinct states, and its transitions and
+%               initial states are pairs and states of that list.  (Kibi
+%               reads the machine from the code at ingest.)
+%   regex       The certificate holds the code's pattern (source, flags and
+%               flavor) or string constant.  (Kibi reads it from the code
+%               at ingest and decides the claim's language exactly.)
+%   source      The certificate names a project source (a reader and its
+%               spec) and holds what Kibi read from it: the members as a
+%               sorted list of distinct strings, and for schema, validator
+%               and route readers the tables, objects or routes.  (Kibi
+%               reads the source itself at ingest and stores its own read.)
 %
 % The digest a receipt records is the sha256 of the certificate's canonical
 % JSON as canonical_json/2 below spells it. The CLI records the digest this
@@ -35,6 +51,7 @@
 :- use_module(library(crypto)).
 :- use_module(library(apply)).
 :- use_module(library(lists)).
+:- use_module(library(yall)).
 :- use_module('intervals.pl', [
     numeric_constraints_satisfiable/2,
     numeric_constraint_entailed/3
@@ -90,8 +107,8 @@ certificate_problem(Certificate, Reason) :-
     ),
     (   kind_problem(Kind, Certificate, Reason0)
     ->  Reason = Reason0
-    ;   \+ memberchk(Kind, [exhaustive, typecheck, arithmetic, smt])
-    ->  Reason = "the certificate kind is not exhaustive, typecheck, arithmetic or smt"
+    ;   \+ memberchk(Kind, [exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex, source])
+    ->  Reason = "the certificate kind is not exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex or source"
     ).
 
 kind_problem(exhaustive, Certificate, Reason) :-
@@ -164,9 +181,18 @@ kind_problem(arithmetic, Certificate, Reason) :-
         arithmetic_constraint(X, Claim, Goal),
         integer_variables(Type, X, Integers),
         (   \+ numeric_constraints_satisfiable(Premises, Integers)
-        ->  Reason = "the assumptions admit no value, so the claim holds vacuously"
+        ->  maplist(constraint_text(Variable), Assumptions, Texts),
+            atomic_list_concat(Texts, ' and ', Joined),
+            format(string(Reason),
+                   "the assumptions contradict each other (~w), so no value satisfies them and they prove nothing about the claim",
+                   [Joined])
         ;   \+ numeric_constraint_entailed(Premises, Goal, Integers)
-        ->  Reason = "the assumptions do not entail the claim: some value satisfies them and breaks it"
+        ->  (   arithmetic_counterexample(Type, Assumptions, Claim, Value)
+            ->  format(string(Reason),
+                       "the assumptions do not entail the claim: ~w = ~w satisfies them and breaks it",
+                       [Variable, Value])
+            ;   Reason = "the assumptions do not entail the claim: some value satisfies them and breaks it"
+            )
         )
     ).
 kind_problem(smt, Certificate, Reason) :-
@@ -185,6 +211,174 @@ kind_problem(smt, Certificate, Reason) :-
     ->  Reason = "the solver did not answer unsat"
     ).
 
+kind_problem(rule, Certificate, Reason) :-
+    field(Certificate, domains, Domains),
+    field(Certificate, predicates, Predicates),
+    (   \+ (is_dict(Domains), dict_pairs(Domains, _, DomainPairs), DomainPairs \== [])
+    ->  Reason = "the certificate has no domains"
+    ;   dict_pairs(Domains, _, DomainPairs),
+        member(Type-Domain, DomainPairs),
+        field(Domain, members, Members),
+        \+ distinct_strings(Members)
+    ->  format(string(Reason), "the domain ~w must list distinct values, at least one", [Type])
+    ;   \+ (is_dict(Predicates), dict_pairs(Predicates, _, PredicatePairs), PredicatePairs \== [])
+    ->  Reason = "the certificate has no predicate tables"
+    ;   dict_pairs(Predicates, _, PredicatePairs),
+        member(Name-Table, PredicatePairs),
+        table_problem(Name, Table, Domains, Reason0)
+    ->  Reason = Reason0
+    ).
+kind_problem(state_machine, Certificate, Reason) :-
+    field(Certificate, machine, Machine),
+    field(Machine, symbol_id, Symbol),
+    field(Machine, states, States),
+    field(Machine, transitions, Transitions),
+    (   \+ is_dict(Machine)
+    ->  Reason = "the certificate has no machine"
+    ;   \+ nonempty_string(Symbol)
+    ->  Reason = "the machine names no symbol_id"
+    ;   \+ distinct_strings(States)
+    ->  Reason = "the machine must list distinct states, at least one"
+    ;   \+ is_list(Transitions)
+    ->  Reason = "the machine has no transitions list"
+    ;   member(Edge, Transitions),
+        \+ ( is_list(Edge), Edge = [From, To], memberchk(From, States), memberchk(To, States) )
+    ->  Reason = "every transition must be a [from, to] pair of the machine's states"
+    ;   msort(Transitions, SortedEdges), sort(Transitions, UniqueEdges), SortedEdges \== UniqueEdges
+    ->  Reason = "the machine lists a transition twice"
+    ;   get_dict(initial, Machine, Initial),
+        \+ ( is_list(Initial), forall(member(S, Initial), memberchk(S, States)) )
+    ->  Reason = "the machine's initial states must be states of the machine"
+    ).
+kind_problem(regex, Certificate, Reason) :-
+    field(Certificate, pattern, Pattern),
+    field(Pattern, symbol_id, Symbol),
+    field(Pattern, type, Type),
+    (   \+ is_dict(Pattern)
+    ->  Reason = "the certificate has no pattern"
+    ;   \+ nonempty_string(Symbol)
+    ->  Reason = "the pattern names no symbol_id"
+    ;   Type == "regexp"
+    ->  field(Pattern, source, Source),
+        field(Pattern, flags, Flags),
+        field(Pattern, flavor, Flavor),
+        (   \+ (string(Source), string(Flags))
+        ->  Reason = "a regexp pattern must give its source and flags"
+        ;   \+ memberchk(Flavor, ["js", "python"])
+        ->  Reason = "a regexp pattern's flavor must be js or python"
+        )
+    ;   Type == "string"
+    ->  field(Pattern, value, Value),
+        \+ string(Value),
+        Reason = "a string pattern must give its value"
+    ;   Reason = "the pattern's type must be regexp or string"
+    ).
+
+% implements REQ-kibi-source-proof-kinds
+kind_problem(source, Certificate, Reason) :-
+    field(Certificate, source, Source),
+    field(Certificate, model, Model),
+    field(Model, members, Members),
+    (   \+ ( is_dict(Source), get_dict(reader, Source, Reader), nonempty_string(Reader) )
+    ->  Reason = "the certificate names no source reader"
+    ;   \+ is_dict(Model)
+    ->  Reason = "the certificate has no model of what Kibi read"
+    ;   \+ sorted_distinct_strings(Members)
+    ->  Reason = "the source model's members must be a sorted list of distinct strings"
+    ;   get_dict(entities, Model, Entities),
+        \+ ( is_list(Entities), maplist(source_entity_ok, Entities) )
+    ->  Reason = "every source entity must have a name and columns of {name, nullable, optional}"
+    ;   get_dict(routes, Model, Routes),
+        \+ ( is_list(Routes), maplist(source_route_ok, Routes) )
+    ->  Reason = "every source route must have a method, a path and a middleware list"
+    ;   get_dict(sequence, Model, Sequence),
+        \+ ( is_list(Sequence), forall(member(Item, Sequence), string(Item)),
+              sort(Sequence, Members) )
+    ->  Reason = "the source model's sequence must list the members in the order read"
+    ).
+
+sorted_distinct_strings(List) :-
+    is_list(List),
+    forall(member(Item, List), string(Item)),
+    sort(List, Sorted),
+    Sorted == List.
+
+source_entity_ok(Entity) :-
+    is_dict(Entity),
+    get_dict(name, Entity, Name), nonempty_string(Name),
+    get_dict(columns, Entity, Columns), is_list(Columns),
+    forall(member(Column, Columns),
+           ( is_dict(Column),
+             get_dict(name, Column, ColumnName), nonempty_string(ColumnName),
+             get_dict(nullable, Column, Nullable), memberchk(Nullable, [true, false]),
+             get_dict(optional, Column, Optional), memberchk(Optional, [true, false]) )),
+    (   get_dict(foreign_keys, Entity, Keys) -> is_list(Keys), forall(member(K, Keys), string(K)) ; true ).
+
+source_route_ok(Route) :-
+    is_dict(Route),
+    get_dict(method, Route, Method), nonempty_string(Method),
+    get_dict(path, Route, Path), nonempty_string(Path),
+    get_dict(middleware, Route, Middleware), is_list(Middleware),
+    forall(member(M, Middleware), string(M)).
+
+% table_problem(+Name, +Table, +Domains, -Reason): the first problem with
+% one predicate table.
+table_problem(Name, Table, Domains, Reason) :-
+    field(Table, symbol_id, Symbol),
+    field(Table, arg_types, Types),
+    field(Table, rows, Rows),
+    (   \+ nonempty_string(Symbol)
+    ->  format(string(Reason), "the table for ~w names no symbol_id", [Name])
+    ;   \+ (is_list(Types), Types \== [], length(Types, Arity), Arity =< 8,
+             forall(member(T, Types), (string(T), atom_string(TA, T), get_dict(TA, Domains, _))))
+    ->  format(string(Reason), "the table for ~w must name 1 to 8 argument types, each with a domain", [Name])
+    ;   \+ is_list(Rows)
+    ->  format(string(Reason), "the table for ~w has no rows", [Name])
+    ;   member(Row, Rows),
+        get_dict(error, Row, Error)
+    ->  get_dict(args, Row, Args),
+        atomic_list_concat(Args, ', ', ArgText),
+        format(string(Reason), "~w(~w) failed: ~w", [Name, ArgText, Error])
+    ;   member(Row, Rows),
+        \+ table_row(Row, Types, Domains)
+    ->  format(string(Reason), "every row of ~w must give one value per argument from its domain and a boolean", [Name])
+    ;   findall(Args, (member(Row, Rows), get_dict(args, Row, Args)), AllArgs),
+        msort(AllArgs, SortedArgs),
+        sort(AllArgs, UniqueArgs),
+        SortedArgs \== UniqueArgs
+    ->  format(string(Reason), "the table for ~w lists a combination twice", [Name])
+    ;   length(Rows, Count),
+        foldl(domain_product(Domains), Types, 1, Expected),
+        Count =\= Expected
+    ->  format(string(Reason), "the table for ~w has ~d rows, not one per combination of its domains (~d)", [Name, Count, Expected])
+    ).
+
+domain_product(Domains, Type, Count0, Count) :-
+    atom_string(TypeKey, Type),
+    get_dict(TypeKey, Domains, Domain),
+    get_dict(members, Domain, Members),
+    length(Members, N),
+    Count is Count0 * N.
+
+table_row(Row, Types, Domains) :-
+    is_dict(Row),
+    get_dict(args, Row, Args),
+    is_list(Args),
+    same_length(Args, Types),
+    forall(nth1(I, Args, Arg),
+           ( nth1(I, Types, T), atom_string(TA, T), get_dict(TA, Domains, D),
+             get_dict(members, D, Members), memberchk(Arg, Members) )),
+    get_dict(value, Row, Value),
+    memberchk(Value, [true, false]).
+
+distinct_strings(Values) :-
+    is_list(Values),
+    Values \== [],
+    maplist(string, Values),
+    msort(Values, Sorted),
+    sort(Values, Unique),
+    Sorted == Unique.
+
 % field(+Dict, +Key, -Value): the value, or '$missing' when absent.
 field(Dict, Key, Value) :-
     (   is_dict(Dict), get_dict(Key, Dict, Value0)
@@ -206,6 +400,51 @@ arithmetic_constraint(X, Row, c(Op, X, Value)) :-
     get_dict(value, Row, Value),
     number(Value).
 
+% "count = 4", for naming an assumption in a rejection.
+constraint_text(Variable, Row, Text) :-
+    get_dict(operator, Row, OpString),
+    get_dict(value, Row, Value),
+    atom_string(Op, OpString),
+    operator_symbol(Op, Symbol),
+    format(atom(Text), "~w ~w ~w", [Variable, Symbol, Value]).
+
+operator_symbol(eq, '=').
+operator_symbol(neq, '!=').
+operator_symbol(lt, '<').
+operator_symbol(lte, '<=').
+operator_symbol(gt, '>').
+operator_symbol(gte, '>=').
+
+% arithmetic_counterexample(+Type, +Assumptions, +Claim, -Value): a value
+% next to one of the constants that satisfies every assumption and breaks the
+% claim, so a rejection can name it (a count of 5 against "exactly 4").
+arithmetic_counterexample(Type, Assumptions, Claim, Value) :-
+    findall(C, (member(Row, [Claim|Assumptions]), get_dict(value, Row, C)), Constants),
+    (   Type == "int" -> Step = 1 ; Step = 0.5 ),
+    findall(V,
+            (   member(C, [0|Constants]),
+                member(D, [0, -1, 1]),
+                V is C + D*Step,
+                (   Type == "int" -> integer(V) ; true )
+            ),
+            Candidates0),
+    sort(Candidates0, Candidates),
+    member(Value, Candidates),
+    forall(member(Row, Assumptions), concrete_holds(Row, Value)),
+    \+ concrete_holds(Claim, Value),
+    !.
+
+concrete_holds(Row, X) :-
+    arithmetic_constraint(Y, Row, c(Op, Y, V)),
+    concrete_op(Op, X, V).
+
+concrete_op(eq, X, V) :- X =:= V.
+concrete_op(neq, X, V) :- X =\= V.
+concrete_op(lt, X, V) :- X < V.
+concrete_op(lte, X, V) :- X =< V.
+concrete_op(gt, X, V) :- X > V.
+concrete_op(gte, X, V) :- X >= V.
+
 integer_variables("int", X, [X]).
 integer_variables("real", _, []).
 

package/src/discovery.pl

@@ -9,6 +9,7 @@
     coverage_report_json/12,
     coverage_report_json/13,
     coverage_evidence_json/5,
+    coverage_evidence_json/7,
     evidence_floor_json/6,
     requirement_proof_json/5,
     requirement_proof_json/7,
@@ -155,12 +156,14 @@ symbol_explain_role(_SymbolId, unknown).
 % not used: they take seconds on a large KB. The functional-predicate
 % declarations a rule comparison reads are collected once per call rather
 % than once per compared pair, which dominated the cost for requirements with
-% many rules. A requirement whose checks raise an error reports that error
-% instead of failing the answer. Scope names the snapshot the verdicts were
-% computed from.
+% many rules; the infeasible success scenarios are likewise analysed once per
+% call rather than once per requirement. A requirement whose checks raise an
+% error reports that error instead of failing the answer. Scope names the
+% snapshot the verdicts were computed from.
 search_answer_verdicts_json(ReqIds, JsonString) :-
     search_answer_functional(Functional),
-    maplist(search_answer_verdict(Functional), ReqIds, Verdicts),
+    search_answer_infeasible(Infeasible),
+    maplist(search_answer_verdict(Functional, Infeasible), ReqIds, Verdicts),
     status_scope_dict(Scope),
     dict_json_string(_{requirements: Verdicts, scope: Scope}, JsonString).
 
@@ -171,14 +174,27 @@ search_answer_functional(some(Functional)) :-
     !.
 search_answer_functional(none).
 
+% Every infeasible success scenario, analysed once per call: the analysis
+% walks every success scenario, so running it per requirement multiplied a
+% whole-KB pass by the number of requirements in the answer. When it raises,
+% each requirement's forbids check raises the same error itself and reports
+% it as that requirement's error, as before.
+search_answer_infeasible(some(Infeasible)) :-
+    catch(findall(infeasible(ScenarioId, ReqIds, AssumedFacts, ReqFacts, Reason),
+                  infeasible_scenario(ScenarioId, ReqIds, AssumedFacts, ReqFacts, Reason),
+                  Infeasible),
+          _, fail),
+    !.
+search_answer_infeasible(none).
+
 search_answer_rule_status(some(Functional), RuleA, RuleB, Status) :-
     !,
     logic_rule_conflict(RuleA, RuleB, Functional, Status).
 search_answer_rule_status(none, RuleA, RuleB, Status) :-
     logic_rule_conflict(RuleA, RuleB, Status).
 
-search_answer_verdict(Functional, ReqId, Verdict) :-
-    catch(search_answer_verdict_(Functional, ReqId, Verdict0), Error, true),
+search_answer_verdict(Functional, Infeasible, ReqId, Verdict) :-
+    catch(search_answer_verdict_(Functional, Infeasible, ReqId, Verdict0), Error, true),
     (   var(Error)
     ->  Verdict = Verdict0
     ;   format(string(Text0), "~q", [Error]),
@@ -186,7 +202,7 @@ search_answer_verdict(Functional, ReqId, Verdict) :-
         Verdict = _{id: ReqId, error: Text}
     ).
 
-search_answer_verdict_(Functional, ReqId, _{
+search_answer_verdict_(Functional, Infeasible, ReqId, _{
     id: ReqId,
     contradictions: Contradictions,
     scenarios: Scenarios,
@@ -197,7 +213,7 @@ search_answer_verdict_(Functional, ReqId, _{
     sort(Contradictions0, Contradictions),
     findall(S, search_answer_scenario_outcome(ReqId, S), Scenarios0),
     sort(Scenarios0, Scenarios),
-    findall(F, search_answer_forbidden_scenario(ReqId, F), Forbids0),
+    findall(F, search_answer_forbidden_scenario(Infeasible, ReqId, F), Forbids0),
     sort(Forbids0, Forbids),
     search_answer_inventory(ReqId, Inventory).
 
@@ -291,7 +307,18 @@ search_answer_outcome(ScenarioId, Result, _{scenario: ScenarioId, outcome: Outco
     ;   format(atom(Outcome), "~q", [Result])
     ).
 
-search_answer_forbidden_scenario(ReqId, _{
+search_answer_forbidden_scenario(some(Infeasible), ReqId, _{
+    scenario: ScenarioId,
+    assumed: AssumedFacts,
+    fact: ReqFacts,
+    reason: Reason
+}) :-
+    member(infeasible(ScenarioId, ReqIds, AssumedFacts, ReqFacts, RawReason), Infeasible),
+    memberchk(ReqId, ReqIds),
+    \+ kb_relationship(specified_by, ReqId, ScenarioId),
+    search_answer_text(RawReason, Reason).
+
+search_answer_forbidden_scenario(none, ReqId, _{
     scenario: ScenarioId,
     assumed: AssumedFacts,
     fact: ReqFacts,
@@ -352,6 +379,16 @@ search_answer_clip(Text, Max, Clipped) :-
 % the full coverage row set, keeping the response small on large KBs.
 coverage_evidence_json(Tags, VerificationSnapshot, CheckedAt, MaxAgeSeconds, JsonString) :-
     requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds, ProofContext),
+    coverage_evidence_rows_json(Tags, ProofContext, JsonString).
+
+% The same rows under a receipt binding mode, so kb_check judges receipts
+% like kb_coverage and kibi proof explain: per_contract with the TestId ->
+% binding hash dict, or strict_snapshot.
+coverage_evidence_json(Tags, BindingMode, TestBindings, VerificationSnapshot, CheckedAt, MaxAgeSeconds, JsonString) :-
+    requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds, BindingMode, TestBindings, ProofContext),
+    coverage_evidence_rows_json(Tags, ProofContext, JsonString).
+
+coverage_evidence_rows_json(Tags, ProofContext, JsonString) :-
     findall(Evidence,
         (   kb_entity(Id, req, Props),
             matches_tags(Tags, Props),
@@ -479,9 +516,9 @@ coverage_report_json(By, Tags, IncludePassing, BindingMode, TestBindings, Includ
         binding(By, Tags, IncludePassing, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         binding_coverage_rows(By, Tags, IncludePassing, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         SortedRows,
-        Summary),
+        Summary,
+        Meta),
     paginate_rows(SortedRows, Offset, Limit, Rows),
-    status_meta_dict(Meta),
     Response = _{summary: Summary, rows: Rows, meta: Meta},
     dict_json_string(Response, JsonString).
 
@@ -497,9 +534,9 @@ coverage_report_json(By, Tags, IncludePassing, StatusFilter, IncludeTransitive,
         status(By, Tags, IncludePassing, StatusFilter, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         status_filtered_coverage_rows(By, Tags, IncludePassing, StatusFilter, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         SortedRows,
-        Summary),
+        Summary,
+        Meta),
     paginate_rows(SortedRows, Offset, Limit, Rows),
-    status_meta_dict(Meta),
     Response = _{summary: Summary, rows: Rows, meta: Meta},
     dict_json_string(Response, JsonString).
 
@@ -512,9 +549,9 @@ coverage_report_json(By, Tags, IncludePassing, StatusFilter, BindingMode, TestBi
         status_binding(By, Tags, IncludePassing, StatusFilter, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         status_binding_coverage_rows(By, Tags, IncludePassing, StatusFilter, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         SortedRows,
-        Summary),
+        Summary,
+        Meta),
     paginate_rows(SortedRows, Offset, Limit, Rows),
-    status_meta_dict(Meta),
     Response = _{summary: Summary, rows: Rows, meta: Meta},
     dict_json_string(Response, JsonString).
 
@@ -531,26 +568,31 @@ binding_coverage_rows(req, Tags, IncludePassing, BindingMode, TestBindings, Incl
 binding_coverage_rows(By, Tags, IncludePassing, _BindingMode, _TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds, Rows, Summary) :-
     coverage_rows(By, Tags, IncludePassing, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds, Rows, Summary).
 
-:- dynamic coverage_memo/3.
+:- dynamic coverage_memo/4.
 
-%% memo_sorted_coverage(+Args, :Compute, -SortedRows, -Summary)
+%% memo_sorted_coverage(+Args, :Compute, -SortedRows, -Summary, -Meta)
 % Large coverage reports are fetched in bounded pages so no single answer
 % approaches the engine's output cap. Every page would otherwise recompute
 % the whole report; keep the most recent sorted result for the exact
 % arguments, graph, and RDF generation. Coverage reads only the store and its
-% arguments, so the memo is invalidated by any store change.
-memo_sorted_coverage(Args, Compute, SortedRows, Summary) :-
+% arguments, so the memo is invalidated by any store change. The status meta
+% is kept with it: its freshness check stats every indexed source, which cost
+% more than the page itself, and the pages of one report share its arguments
+% (including the check time), so they describe the same snapshot.
+memo_sorted_coverage(Args, Compute, SortedRows, Summary, Meta) :-
     (kb:kb_graph(Graph) -> true ; Graph = none),
     rdf_generation(Generation),
     Key = key(Args, Graph, Generation),
-    (   coverage_memo(Stored, StoredRows, StoredSummary),
+    (   coverage_memo(Stored, StoredRows, StoredSummary, StoredMeta),
         Stored =@= Key
     ->  SortedRows = StoredRows,
-        Summary = StoredSummary
+        Summary = StoredSummary,
+        Meta = StoredMeta
     ;   call(Compute, Rows0, Summary),
         sort_dict_rows(Rows0, SortedRows),
-        retractall(coverage_memo(_, _, _)),
-        assertz(coverage_memo(Key, SortedRows, Summary))
+        status_meta_dict(Meta),
+        retractall(coverage_memo(_, _, _, _)),
+        assertz(coverage_memo(Key, SortedRows, Summary, Meta))
     ).
 
 status_filtered_coverage_rows(By, Tags, IncludePassing, [], IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds, Rows, Summary) :-

package/src/intervals.pl

@@ -22,6 +22,7 @@
 %% numeric_constraints_satisfiable(+Constraints)
 % True when some assignment of reals satisfies every constraint.
 numeric_constraints_satisfiable(Constraints) :-
+    % mutalog-disable-next-line literal: [_] names no variable, so it equals []
     numeric_constraints_satisfiable(Constraints, []).
 
 %% numeric_constraints_satisfiable(+Constraints, +IntegerVariables)
@@ -43,6 +44,7 @@ numeric_constraints_satisfiable(Constraints, IntegerVariables) :-
 %% numeric_constraint_entailed(+Premises, +Constraint)
 % True when every assignment that satisfies Premises satisfies Constraint.
 numeric_constraint_entailed(Premises, Constraint) :-
+    % mutalog-disable-next-line literal: [_] names no variable, so it equals []
     numeric_constraint_entailed(Premises, Constraint, []).
 
 %% numeric_constraint_entailed(+Premises, +Constraint, +IntegerVariables)
@@ -60,12 +62,12 @@ finite_constraint(c(_Op, _Variable, Value)) :-
     ;   true
     ).
 
-integer_variable(_, all) :- !.
+% Only called as an if-then-else condition, which keeps the first answer.
+integer_variable(_, all).
 integer_variable(Variable, IntegerVariables) :-
     is_list(IntegerVariables),
     member(Candidate, IntegerVariables),
-    Candidate == Variable,
-    !.
+    Candidate == Variable.
 
 %% numeric_constraint_negation(+Constraint, -Negated)
 numeric_constraint_negation(c(Op, Variable, Value), c(Negated, Variable, Value)) :-
@@ -80,10 +82,15 @@ negated_operator(gt, lte).
 
 %% numeric_constraint_holds(+Op, +Left, +Right)
 % Evaluate a comparison between two numbers.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(eq, Left, Right) :- Left =:= Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(neq, Left, Right) :- Left =\= Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(lt, Left, Right) :- Left < Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(lte, Left, Right) :- Left =< Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(gt, Left, Right) :- Left > Right.
 numeric_constraint_holds(gte, Left, Right) :- Left >= Right.
 
@@ -94,14 +101,18 @@ variable_feasible(Variable, Constraints) :-
 
 % interval(Low, LowKind, High, HighKind, Excluded)
 apply_bound(eq-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo1, LoK1, Hi1, HiK1, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     raise_low(Lo, LoK, Value, closed, Lo1, LoK1),
     lower_high(Hi, HiK, Value, closed, Hi1, HiK1).
 apply_bound(neq-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo, LoK, Hi, HiK, [Value|Ex])).
 apply_bound(lt-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo, LoK, Hi1, HiK1, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     lower_high(Hi, HiK, Value, open, Hi1, HiK1).
 apply_bound(lte-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo, LoK, Hi1, HiK1, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     lower_high(Hi, HiK, Value, closed, Hi1, HiK1).
 apply_bound(gt-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo1, LoK1, Hi, HiK, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     raise_low(Lo, LoK, Value, open, Lo1, LoK1).
 apply_bound(gte-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo1, LoK1, Hi, HiK, Ex)) :-
     raise_low(Lo, LoK, Value, closed, Lo1, LoK1).
@@ -116,13 +127,18 @@ lower_high(Hi, _, Value, Kind, Value, Kind) :- Value < Hi, !.
 lower_high(Hi, HiK, Value, Kind, Hi, Kind1) :- Value =:= Hi, !, tighter_kind(HiK, Kind, Kind1).
 lower_high(Hi, HiK, _, _, Hi, HiK).
 
+% mutalog-disable-next-line cut: the second answer, open, only shrinks the interval
 tighter_kind(closed, closed, closed) :- !.
 tighter_kind(_, _, open).
 
 % An unbounded or non-degenerate real interval cannot be emptied by finitely
 % many excluded points.  A degenerate interval is a single closed point.
+% The callers keep only the first answer, so the cuts are not observable.
+% mutalog-disable-next-line cut
 interval_non_empty(interval(ninf, _, _, _, _)) :- !.
+% mutalog-disable-next-line cut
 interval_non_empty(interval(_, _, pinf, _, _)) :- !.
+% mutalog-disable-next-line cut
 interval_non_empty(interval(Lo, _, Hi, _, _)) :- Lo < Hi, !.
 interval_non_empty(interval(Lo, closed, Hi, closed, Excluded)) :-
     Lo =:= Hi,
@@ -131,34 +147,37 @@ interval_non_empty(interval(Lo, closed, Hi, closed, Excluded)) :-
 % Integer variables: every strict or fractional bound is tightened to the
 % nearest admissible integer, so the set is an integer range [Lo, Hi] minus
 % finitely many excluded integers.  An eq bound with a fractional value admits
-% no integer at all.
+% no integer at all, so the fold fails.  The operators are distinct, so the
+% cuts after the heads are not observable.
 integer_variable_feasible(Variable, Constraints) :-
     findall(Op-Value, (member(c(Op, Other, Value), Constraints), Other == Variable), Bounds),
     foldl(apply_integer_bound, Bounds, ibox(ninf, pinf, []), Box),
     integer_box_non_empty(Box).
 
-apply_integer_bound(_, empty, empty) :- !.
-apply_integer_bound(eq-Value, ibox(Lo, Hi, Ex), Box) :- !,
-    (   integral_value(Value, Integer)
-    ->  integer_raise_low(Lo, Integer, Lo1),
-        integer_lower_high(Hi, Integer, Hi1),
-        Box = ibox(Lo1, Hi1, Ex)
-    ;   Box = empty
-    ).
+% mutalog-disable-next-line cut
+apply_integer_bound(eq-Value, ibox(Lo, Hi, Ex), ibox(Lo1, Hi1, Ex)) :- !,
+    integral_value(Value, Integer),
+    integer_raise_low(Lo, Integer, Lo1),
+    integer_lower_high(Hi, Integer, Hi1).
+% mutalog-disable-next-line cut
 apply_integer_bound(neq-Value, ibox(Lo, Hi, Ex), ibox(Lo, Hi, Ex1)) :- !,
     (   integral_value(Value, Integer)
     ->  Ex1 = [Integer|Ex]
     ;   Ex1 = Ex
     ).
+% mutalog-disable-next-line cut
 apply_integer_bound(gt-Value, ibox(Lo, Hi, Ex), ibox(Lo1, Hi, Ex)) :- !,
     Bound is floor(Value) + 1,
     integer_raise_low(Lo, Bound, Lo1).
+% mutalog-disable-next-line cut
 apply_integer_bound(gte-Value, ibox(Lo, Hi, Ex), ibox(Lo1, Hi, Ex)) :- !,
     Bound is ceiling(Value),
     integer_raise_low(Lo, Bound, Lo1).
+% mutalog-disable-next-line cut
 apply_integer_bound(lt-Value, ibox(Lo, Hi, Ex), ibox(Lo, Hi1, Ex)) :- !,
     Bound is ceiling(Value) - 1,
     integer_lower_high(Hi, Bound, Hi1).
+% mutalog-disable-next-line cut
 apply_integer_bound(lte-Value, ibox(Lo, Hi, Ex), ibox(Lo, Hi1, Ex)) :- !,
     Bound is floor(Value),
     integer_lower_high(Hi, Bound, Hi1).
@@ -175,11 +194,13 @@ integer_lower_high(pinf, Bound, Bound) :- !.
 integer_lower_high(Hi, Bound, Hi1) :- Hi1 is min(Hi, Bound).
 
 % An unbounded integer range cannot be emptied by finitely many exclusions.
-integer_box_non_empty(empty) :- !, fail.
+% A range with Lo above Hi has a non-positive size, so it fails the count.
+% The callers keep only the first answer, so the cuts are not observable.
+% mutalog-disable-next-line cut
 integer_box_non_empty(ibox(ninf, _, _)) :- !.
+% mutalog-disable-next-line cut
 integer_box_non_empty(ibox(_, pinf, _)) :- !.
 integer_box_non_empty(ibox(Lo, Hi, Excluded)) :-
-    Lo =< Hi,
     findall(Value, (member(Value, Excluded), Value >= Lo, Value =< Hi), Inside0),
     sort(Inside0, Inside),
     length(Inside, ExcludedCount),