kibi-core 0.26.1 → 0.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-core",
-  "version": "0.26.1",
+  "version": "0.27.0",
   "private": false,
   "description": "Core Prolog modules and RDF graph logic for Kibi",
   "type": "module",

package/src/checks.pl

@@ -6,7 +6,11 @@
 :- module(checks, [
     check_all/1,                    % Returns all violations as a dict
     check_all_json/1,               % Returns all violations as JSON string
+    check_all_json_file/2,          % Writes all violations as JSON to a file
     check_selected_json/2,           % Returns only selected rule violations as JSON
+    check_selected_json_file/2,      % Writes selected rule violations as JSON to a file
+    check_all_json_transport/4,      % File transport with an answer fallback
+    check_selected_json_transport/4, % Same, for selected rules
     check_must_priority_coverage/1, % Returns list of must-priority violations
     check_symbol_coverage/1,        % Returns list of uncovered symbols
     check_changed_symbol_coverage/2, % symbol-coverage restricted to a staged change set
@@ -470,7 +474,7 @@ parse_json_object(Dict, Dict) :-
     !.
 parse_json_object(Raw, Dict) :-
     (atom(Raw) ; string(Raw)),
-    catch(atom_json_dict(Raw, Dict, [value_string_as(string)]), _, fail),
+    json_text_term(Raw, Dict),
     is_dict(Dict).
 
 parse_json_list(Raw, Entries) :-
@@ -482,9 +486,48 @@ parse_json_list(^^(Value, _), Entries) :-
     parse_json_list(Value, Entries).
 parse_json_list(Raw, Entries) :-
     (atom(Raw) ; string(Raw)),
-    catch(atom_json_dict(Raw, Entries, [value_string_as(string)]), _, fail),
+    json_text_term(Raw, Entries),
     is_list(Entries).
 
+% The same JSON text (a rule body, a claim inventory, a receipt history) is
+% parsed by several rules and by every requirement that links the fact, so
+% the parsed term is kept by its text.  Parsing is a pure function of the
+% text, so the memo never goes stale; it is bounded so a long-lived engine
+% cannot grow it without limit.
+:- dynamic json_text_memo/2.
+:- dynamic json_text_memo_size/1.
+
+% mutalog-disable-next-line literal: the bound is a tuning value; any size gives the same answers
+json_text_memo_limit(16384).
+
+json_text_term(Raw, Term) :-
+    atom_string(Text, Raw),
+    (   json_text_memo(Text, Stored)
+    ->  Stored = parsed(Term)
+    ;   (   catch(atom_json_dict(Text, Parsed, [value_string_as(string)]), _, fail)
+        ->  Stored = parsed(Parsed)
+        ;   Stored = invalid
+        ),
+        json_text_remember(Text, Stored),
+        Stored = parsed(Term)
+    ).
+
+json_text_remember(Text, Stored) :-
+    (   json_text_memo_size(Size)
+    ->  true
+    ;   Size = 0
+    ),
+    json_text_memo_limit(Limit),
+    (   Size >= Limit
+    ->  retractall(json_text_memo(_, _)),
+        retractall(json_text_memo_size(_)),
+        Next = 1
+    ;   retractall(json_text_memo_size(_)),
+        Next is Size + 1
+    ),
+    assertz(json_text_memo(Text, Stored)),
+    assertz(json_text_memo_size(Next)).
+
 %% check_no_dangling_refs(-Violations)
 % Finds all relationships referencing non-existent entities.
 check_no_dangling_refs(Violations) :-
@@ -1281,7 +1324,28 @@ analysis_outcome(analysis([], [], false, []), feasible).
 % advisory reasons in reporting order; ByException is true when some check is
 % satisfiable only because an approved exception waived a constraint;
 % NotApplicable is non-empty only when no assumption is governed at all.
-scenario_feasibility_analysis(ScenarioId, analysis(Witnesses, Unknowns, ByException, NotApplicable)) :-
+% The analysis of a scenario is kept per KB generation: the blocking rule,
+% the unknown-feasibility rule and every requirement's proof ladder ask for
+% the same scenarios.  Inside a transaction (what-if staging) the KB is not
+% the generation's, so the analysis is computed afresh.
+scenario_feasibility_analysis(ScenarioId, Analysis) :-
+    (   nonvar(ScenarioId),
+        \+ rdf_db:rdf_active_transaction(_),
+        kb:index_verification_key(scenario_feasibility, Key)
+    ->  (   kb:kb_scenario_feasibility_memo(ScenarioId, Key, Analysis0)
+        ->  Analysis = Analysis0
+        ;   compute_scenario_feasibility_analysis(ScenarioId, Analysis),
+            (   once(kb:kb_scenario_feasibility_memo(_, Stored, _)),
+                Stored \== Key
+            ->  retractall(kb:kb_scenario_feasibility_memo(_, _, _))
+            ;   true
+            ),
+            assertz(kb:kb_scenario_feasibility_memo(ScenarioId, Key, Analysis))
+        )
+    ;   compute_scenario_feasibility_analysis(ScenarioId, Analysis)
+    ).
+
+compute_scenario_feasibility_analysis(ScenarioId, analysis(Witnesses, Unknowns, ByException, NotApplicable)) :-
     findall(FactId, kb_relationship(assumes, ScenarioId, FactId), Assumed0),
     sort(Assumed0, Assumed),
     (   Assumed == []
@@ -2526,7 +2590,24 @@ check_domain_contradictions_and_witnesses(Violations, Witnesses) :-
 % Exact, JSON-safe evidence for every strict-property, ground-predicate, and
 % safe-rule contradiction result.  Rule overlap that cannot be proven or
 % disproven remains status=unresolved rather than becoming consistency.
+%
+% kb_check, kb_coverage and the proof context each ask for every witness, so
+% the result is memoized per KB generation, like the entity property memo.
+% Inside an RDF transaction (the what-if staging) it is always recomputed.
 check_domain_contradiction_witnesses(Witnesses) :-
+    (   \+ rdf_db:rdf_active_transaction(_),
+        kb:index_verification_key(domain_contradictions, Key)
+    ->  (   kb:kb_contradiction_witness_memo(Key, Cached)
+        ->  Witnesses = Cached
+        ;   compute_domain_contradiction_witnesses(Computed),
+            retractall(kb:kb_contradiction_witness_memo(_, _)),
+            assertz(kb:kb_contradiction_witness_memo(Key, Computed)),
+            Witnesses = Computed
+        )
+    ;   compute_domain_contradiction_witnesses(Witnesses)
+    ).
+
+compute_domain_contradiction_witnesses(Witnesses) :-
     findall(Witness, req_conflict_witness(_ReqA, _ReqB, Witness), GroundWitnesses),
     functional_predicate_declarations(Functional),
     findall(Witness, rule_contradiction_witness(Functional, Witness), RuleWitnesses),
@@ -2701,22 +2782,42 @@ opposing_rule_requirements(ReqA, ReqB, RuleA, RuleB) :-
 % Each unordered pair of (requirement, rule fact) endpoints is compared once,
 % ordered by the requirement-fact pair: ordering requirements and facts
 % independently would never compare REQ-A->FACT-Z with REQ-Z->FACT-A.
+%
+% Only current requirements with requires_rule links can pair, so the pairs
+% are drawn from that list (in current_req/1 order, each with its rule links
+% in relationship order) rather than from every pair of current
+% requirements; solutions and their order are unchanged.
 opposing_rule_requirement_facts(ReqA, ReqB, FactA, FactB, RuleA, RuleB) :-
-    kb:current_req(ReqA),
-    kb:current_req(ReqB),
+    rule_requirement_links(Links),
+    member(ReqA-RulesA, Links),
+    member(ReqB-RulesB, Links),
     ReqA \== ReqB,
-    kb_relationship(requires_rule, ReqA, FactA),
-    kb_relationship(requires_rule, ReqB, FactB),
+    member(FactA-RuleA, RulesA),
+    member(FactB-RuleB, RulesB),
     FactA \== FactB,
-    ReqA-FactA @< ReqB-FactB,
-    kb_entity(FactA, fact, PropsA),
-    kb_entity(FactB, fact, PropsB),
-    memberchk(fact_kind=KindA, PropsA),
-    memberchk(fact_kind=KindB, PropsB),
-    normalize_term_atom(KindA, rule),
-    normalize_term_atom(KindB, rule),
-    logic_rule_from_props(PropsA, RuleA),
-    logic_rule_from_props(PropsB, RuleB).
+    % mutalog-disable-next-line compare: equal endpoints need ReqA == ReqB, which is excluded above
+    ReqA-FactA @< ReqB-FactB.
+
+% Each requirement's rule facts with their parsed rules, read once rather
+% than once per pair: a link to a fact that is not a rule, or whose rule does
+% not parse, never pairs.
+rule_requirement_links(Links) :-
+    findall(ReqId-Rules,
+            ( kb:current_req(ReqId),
+              findall(FactId-Rule,
+                      ( kb_relationship(requires_rule, ReqId, FactId),
+                        rule_fact_rule(FactId, Rule) ),
+                      Rules),
+              % mutalog-disable-next-line goal_true,literal: a requirement without rules never pairs; this only prunes
+              Rules \== [] ),
+            Links).
+
+rule_fact_rule(FactId, Rule) :-
+    kb_entity(FactId, fact, Props),
+    memberchk(fact_kind=Kind, Props),
+    % mutalog-disable-next-line goal_true: only a rule fact carries a rule body to decode
+    normalize_term_atom(Kind, rule),
+    logic_rule_from_props(Props, Rule).
 
 rule_contradiction_witness(Functional, Witness) :-
     opposing_rule_requirement_facts(ReqA, ReqB, FactA, FactB, RuleA, RuleB),
@@ -3472,7 +3573,7 @@ inventory_entries(Raw, Entries) :-
     (   is_list(Raw) -> Entries = Raw
     ;   Raw = ^^(Value, _) -> inventory_entries(Value, Entries)
     ;   (atom(Raw) ; string(Raw)),
-        catch(atom_json_dict(Raw, JsonEntries, [value_string_as(string)]), _, fail),
+        json_text_term(Raw, JsonEntries),
         is_list(JsonEntries)
     ->  Entries = JsonEntries
     ;   (atom(Raw) ; string(Raw)),
@@ -3748,6 +3849,66 @@ check_all_json_with_options(JsonString, RequireAdr) :-
         JsonString
     ).
 
+%% check_all_json_file(+Path, +RequireAdr)
+% Writes the JSON check_all_json_with_options/2 would answer to Path.
+% The answer itself carries no violations, so a large KB's report is never
+% bounded by the engine's output capacity; the caller reads the file.
+check_all_json_file(Path, RequireAdr) :-
+    check_all_with_options(ViolationsDict, RequireAdr),
+    violations_json_to_file(ViolationsDict, Path).
+
+%% check_selected_json_file(+Rules, +Path)
+% File-transport form of check_selected_json/2.
+check_selected_json_file(Rules, Path) :-
+    check_selected(Rules, ViolationsDict),
+    violations_json_to_file(ViolationsDict, Path).
+
+%% check_all_json_transport(+Path, +RequireAdr, -Transport, -JsonString)
+% Writes the violations JSON to Path (Transport = file, JsonString = ''), or
+% answers it as JsonString (Transport = answer) when Path is `none` or the
+% file cannot be written: a full or read-only temp folder, or an engine that
+% cannot reach the caller's temp folder, must not fail a check that fits in
+% an answer.
+check_all_json_transport(Path, RequireAdr, Transport, JsonString) :-
+    check_all_with_options(ViolationsDict, RequireAdr),
+    violations_json_transport(ViolationsDict, Path, Transport, JsonString).
+
+%% check_selected_json_transport(+Rules, +Path, -Transport, -JsonString)
+% check_all_json_transport/4 for the named rules only.
+check_selected_json_transport(Rules, Path, Transport, JsonString) :-
+    check_selected(Rules, ViolationsDict),
+    violations_json_transport(ViolationsDict, Path, Transport, JsonString).
+
+violations_json_transport(ViolationsDict, Path, Transport, JsonString) :-
+    (   Path \== none,
+        catch(violations_json_to_file(ViolationsDict, Path), Error,
+              (   file_transport_error(Error)
+              ->  fail
+              ;   throw(Error)
+              ))
+    ->  Transport = file,
+        JsonString = ''
+    ;   Transport = answer,
+        violations_dict_to_json(ViolationsDict, JsonDict),
+        with_output_to_string(
+            json_write_dict(current_output, JsonDict, [width(0)]),
+            JsonString
+        )
+    ).
+
+file_transport_error(error(permission_error(_, _, _), _)).
+file_transport_error(error(existence_error(_, _), _)).
+file_transport_error(error(resource_error(_), _)).
+file_transport_error(error(io_error(_, _), _)).
+
+violations_json_to_file(ViolationsDict, Path) :-
+    violations_dict_to_json(ViolationsDict, JsonDict),
+    setup_call_cleanup(
+        open(Path, write, Stream, [encoding(utf8)]),
+        json_write_dict(Stream, JsonDict, [width(0)]),
+        close(Stream)
+    ).
+
 %% check_all_with_options(-ViolationsDict, +RequireAdr)
 % Returns a dict with all violations, respecting options.
 check_all_with_options(ViolationsDict, RequireAdr) :-

package/src/claim_obligations.pl

@@ -35,7 +35,10 @@
 %                              has each member as a required (or nullable)
 %                              field; with property middleware every
 %                              selected route's middleware stands in the
-%                              relation
+%                              relation; with property precedes and
+%                              operator includes each member "A -> B"
+%                              holds in the list read: A and B are in it
+%                              and every A comes before every B
 %   set fact under state_machine with operator includes, subset_of or
 %   excludes, or with property reachable_pairs or required_waypoints
 %       state_machine          the projection stands in the operator's
@@ -230,6 +233,14 @@ source_obligation(FactId, Members, Operator, Result) :-
         )
     ;   Property == middleware
     ->  Result = obligation(_{kind: "route_middleware", operator: OperatorString, members: Members})
+    ;   Property == precedes
+    ->  (   Operator == includes
+        ->  Result = obligation(_{kind: "sequence_precedes", members: Members})
+        ;   format(string(Reason),
+                   "~w is a precedes fact with operator ~w; a source proof decides precedes only with includes (each member \"A -> B\" holds)",
+                   [FactId, Operator]),
+            Result = incompatible(Reason)
+        )
     ;   Result = obligation(_{kind: "set_relation", operator: OperatorString, members: Members})
     ).
 
@@ -350,6 +361,10 @@ obligation_key(Obligation, relation(Operator, Members)) :-
     dict_text(Obligation, operator, Operator),
     obligation_members(Obligation, Members),
     !.
+obligation_key(Obligation, precedes(Members)) :-
+    dict_text(Obligation, kind, "sequence_precedes"),
+    obligation_members(Obligation, Members),
+    !.
 obligation_key(Obligation, middleware(Operator, Members)) :-
     dict_text(Obligation, kind, "route_middleware"),
     dict_text(Obligation, operator, Operator),

package/src/code_certificates.pl

@@ -291,6 +291,10 @@ kind_problem(source, Certificate, Reason) :-
     ;   get_dict(routes, Model, Routes),
         \+ ( is_list(Routes), maplist(source_route_ok, Routes) )
     ->  Reason = "every source route must have a method, a path and a middleware list"
+    ;   get_dict(sequence, Model, Sequence),
+        \+ ( is_list(Sequence), forall(member(Item, Sequence), string(Item)),
+              sort(Sequence, Members) )
+    ->  Reason = "the source model's sequence must list the members in the order read"
     ).
 
 sorted_distinct_strings(List) :-

package/src/discovery.pl

@@ -9,6 +9,7 @@
     coverage_report_json/12,
     coverage_report_json/13,
     coverage_evidence_json/5,
+    coverage_evidence_json/7,
     evidence_floor_json/6,
     requirement_proof_json/5,
     requirement_proof_json/7,
@@ -155,12 +156,14 @@ symbol_explain_role(_SymbolId, unknown).
 % not used: they take seconds on a large KB. The functional-predicate
 % declarations a rule comparison reads are collected once per call rather
 % than once per compared pair, which dominated the cost for requirements with
-% many rules. A requirement whose checks raise an error reports that error
-% instead of failing the answer. Scope names the snapshot the verdicts were
-% computed from.
+% many rules; the infeasible success scenarios are likewise analysed once per
+% call rather than once per requirement. A requirement whose checks raise an
+% error reports that error instead of failing the answer. Scope names the
+% snapshot the verdicts were computed from.
 search_answer_verdicts_json(ReqIds, JsonString) :-
     search_answer_functional(Functional),
-    maplist(search_answer_verdict(Functional), ReqIds, Verdicts),
+    search_answer_infeasible(Infeasible),
+    maplist(search_answer_verdict(Functional, Infeasible), ReqIds, Verdicts),
     status_scope_dict(Scope),
     dict_json_string(_{requirements: Verdicts, scope: Scope}, JsonString).
 
@@ -171,14 +174,27 @@ search_answer_functional(some(Functional)) :-
     !.
 search_answer_functional(none).
 
+% Every infeasible success scenario, analysed once per call: the analysis
+% walks every success scenario, so running it per requirement multiplied a
+% whole-KB pass by the number of requirements in the answer. When it raises,
+% each requirement's forbids check raises the same error itself and reports
+% it as that requirement's error, as before.
+search_answer_infeasible(some(Infeasible)) :-
+    catch(findall(infeasible(ScenarioId, ReqIds, AssumedFacts, ReqFacts, Reason),
+                  infeasible_scenario(ScenarioId, ReqIds, AssumedFacts, ReqFacts, Reason),
+                  Infeasible),
+          _, fail),
+    !.
+search_answer_infeasible(none).
+
 search_answer_rule_status(some(Functional), RuleA, RuleB, Status) :-
     !,
     logic_rule_conflict(RuleA, RuleB, Functional, Status).
 search_answer_rule_status(none, RuleA, RuleB, Status) :-
     logic_rule_conflict(RuleA, RuleB, Status).
 
-search_answer_verdict(Functional, ReqId, Verdict) :-
-    catch(search_answer_verdict_(Functional, ReqId, Verdict0), Error, true),
+search_answer_verdict(Functional, Infeasible, ReqId, Verdict) :-
+    catch(search_answer_verdict_(Functional, Infeasible, ReqId, Verdict0), Error, true),
     (   var(Error)
     ->  Verdict = Verdict0
     ;   format(string(Text0), "~q", [Error]),
@@ -186,7 +202,7 @@ search_answer_verdict(Functional, ReqId, Verdict) :-
         Verdict = _{id: ReqId, error: Text}
     ).
 
-search_answer_verdict_(Functional, ReqId, _{
+search_answer_verdict_(Functional, Infeasible, ReqId, _{
     id: ReqId,
     contradictions: Contradictions,
     scenarios: Scenarios,
@@ -197,7 +213,7 @@ search_answer_verdict_(Functional, ReqId, _{
     sort(Contradictions0, Contradictions),
     findall(S, search_answer_scenario_outcome(ReqId, S), Scenarios0),
     sort(Scenarios0, Scenarios),
-    findall(F, search_answer_forbidden_scenario(ReqId, F), Forbids0),
+    findall(F, search_answer_forbidden_scenario(Infeasible, ReqId, F), Forbids0),
     sort(Forbids0, Forbids),
     search_answer_inventory(ReqId, Inventory).
 
@@ -291,7 +307,18 @@ search_answer_outcome(ScenarioId, Result, _{scenario: ScenarioId, outcome: Outco
     ;   format(atom(Outcome), "~q", [Result])
     ).
 
-search_answer_forbidden_scenario(ReqId, _{
+search_answer_forbidden_scenario(some(Infeasible), ReqId, _{
+    scenario: ScenarioId,
+    assumed: AssumedFacts,
+    fact: ReqFacts,
+    reason: Reason
+}) :-
+    member(infeasible(ScenarioId, ReqIds, AssumedFacts, ReqFacts, RawReason), Infeasible),
+    memberchk(ReqId, ReqIds),
+    \+ kb_relationship(specified_by, ReqId, ScenarioId),
+    search_answer_text(RawReason, Reason).
+
+search_answer_forbidden_scenario(none, ReqId, _{
     scenario: ScenarioId,
     assumed: AssumedFacts,
     fact: ReqFacts,
@@ -352,6 +379,16 @@ search_answer_clip(Text, Max, Clipped) :-
 % the full coverage row set, keeping the response small on large KBs.
 coverage_evidence_json(Tags, VerificationSnapshot, CheckedAt, MaxAgeSeconds, JsonString) :-
     requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds, ProofContext),
+    coverage_evidence_rows_json(Tags, ProofContext, JsonString).
+
+% The same rows under a receipt binding mode, so kb_check judges receipts
+% like kb_coverage and kibi proof explain: per_contract with the TestId ->
+% binding hash dict, or strict_snapshot.
+coverage_evidence_json(Tags, BindingMode, TestBindings, VerificationSnapshot, CheckedAt, MaxAgeSeconds, JsonString) :-
+    requirement_proof_context(VerificationSnapshot, CheckedAt, MaxAgeSeconds, BindingMode, TestBindings, ProofContext),
+    coverage_evidence_rows_json(Tags, ProofContext, JsonString).
+
+coverage_evidence_rows_json(Tags, ProofContext, JsonString) :-
     findall(Evidence,
         (   kb_entity(Id, req, Props),
             matches_tags(Tags, Props),
@@ -479,9 +516,9 @@ coverage_report_json(By, Tags, IncludePassing, BindingMode, TestBindings, Includ
         binding(By, Tags, IncludePassing, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         binding_coverage_rows(By, Tags, IncludePassing, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         SortedRows,
-        Summary),
+        Summary,
+        Meta),
     paginate_rows(SortedRows, Offset, Limit, Rows),
-    status_meta_dict(Meta),
     Response = _{summary: Summary, rows: Rows, meta: Meta},
     dict_json_string(Response, JsonString).
 
@@ -497,9 +534,9 @@ coverage_report_json(By, Tags, IncludePassing, StatusFilter, IncludeTransitive,
         status(By, Tags, IncludePassing, StatusFilter, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         status_filtered_coverage_rows(By, Tags, IncludePassing, StatusFilter, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         SortedRows,
-        Summary),
+        Summary,
+        Meta),
     paginate_rows(SortedRows, Offset, Limit, Rows),
-    status_meta_dict(Meta),
     Response = _{summary: Summary, rows: Rows, meta: Meta},
     dict_json_string(Response, JsonString).
 
@@ -512,9 +549,9 @@ coverage_report_json(By, Tags, IncludePassing, StatusFilter, BindingMode, TestBi
         status_binding(By, Tags, IncludePassing, StatusFilter, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         status_binding_coverage_rows(By, Tags, IncludePassing, StatusFilter, BindingMode, TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds),
         SortedRows,
-        Summary),
+        Summary,
+        Meta),
     paginate_rows(SortedRows, Offset, Limit, Rows),
-    status_meta_dict(Meta),
     Response = _{summary: Summary, rows: Rows, meta: Meta},
     dict_json_string(Response, JsonString).
 
@@ -531,26 +568,31 @@ binding_coverage_rows(req, Tags, IncludePassing, BindingMode, TestBindings, Incl
 binding_coverage_rows(By, Tags, IncludePassing, _BindingMode, _TestBindings, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds, Rows, Summary) :-
     coverage_rows(By, Tags, IncludePassing, IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds, Rows, Summary).
 
-:- dynamic coverage_memo/3.
+:- dynamic coverage_memo/4.
 
-%% memo_sorted_coverage(+Args, :Compute, -SortedRows, -Summary)
+%% memo_sorted_coverage(+Args, :Compute, -SortedRows, -Summary, -Meta)
 % Large coverage reports are fetched in bounded pages so no single answer
 % approaches the engine's output cap. Every page would otherwise recompute
 % the whole report; keep the most recent sorted result for the exact
 % arguments, graph, and RDF generation. Coverage reads only the store and its
-% arguments, so the memo is invalidated by any store change.
-memo_sorted_coverage(Args, Compute, SortedRows, Summary) :-
+% arguments, so the memo is invalidated by any store change. The status meta
+% is kept with it: its freshness check stats every indexed source, which cost
+% more than the page itself, and the pages of one report share its arguments
+% (including the check time), so they describe the same snapshot.
+memo_sorted_coverage(Args, Compute, SortedRows, Summary, Meta) :-
     (kb:kb_graph(Graph) -> true ; Graph = none),
     rdf_generation(Generation),
     Key = key(Args, Graph, Generation),
-    (   coverage_memo(Stored, StoredRows, StoredSummary),
+    (   coverage_memo(Stored, StoredRows, StoredSummary, StoredMeta),
         Stored =@= Key
     ->  SortedRows = StoredRows,
-        Summary = StoredSummary
+        Summary = StoredSummary,
+        Meta = StoredMeta
     ;   call(Compute, Rows0, Summary),
         sort_dict_rows(Rows0, SortedRows),
-        retractall(coverage_memo(_, _, _)),
-        assertz(coverage_memo(Key, SortedRows, Summary))
+        status_meta_dict(Meta),
+        retractall(coverage_memo(_, _, _, _)),
+        assertz(coverage_memo(Key, SortedRows, Summary, Meta))
     ).
 
 status_filtered_coverage_rows(By, Tags, IncludePassing, [], IncludeTransitive, VerificationSnapshot, CheckedAt, MaxAgeSeconds, Rows, Summary) :-

package/src/intervals.pl

@@ -22,6 +22,7 @@
 %% numeric_constraints_satisfiable(+Constraints)
 % True when some assignment of reals satisfies every constraint.
 numeric_constraints_satisfiable(Constraints) :-
+    % mutalog-disable-next-line literal: [_] names no variable, so it equals []
     numeric_constraints_satisfiable(Constraints, []).
 
 %% numeric_constraints_satisfiable(+Constraints, +IntegerVariables)
@@ -43,6 +44,7 @@ numeric_constraints_satisfiable(Constraints, IntegerVariables) :-
 %% numeric_constraint_entailed(+Premises, +Constraint)
 % True when every assignment that satisfies Premises satisfies Constraint.
 numeric_constraint_entailed(Premises, Constraint) :-
+    % mutalog-disable-next-line literal: [_] names no variable, so it equals []
     numeric_constraint_entailed(Premises, Constraint, []).
 
 %% numeric_constraint_entailed(+Premises, +Constraint, +IntegerVariables)
@@ -60,12 +62,12 @@ finite_constraint(c(_Op, _Variable, Value)) :-
     ;   true
     ).
 
-integer_variable(_, all) :- !.
+% Only called as an if-then-else condition, which keeps the first answer.
+integer_variable(_, all).
 integer_variable(Variable, IntegerVariables) :-
     is_list(IntegerVariables),
     member(Candidate, IntegerVariables),
-    Candidate == Variable,
-    !.
+    Candidate == Variable.
 
 %% numeric_constraint_negation(+Constraint, -Negated)
 numeric_constraint_negation(c(Op, Variable, Value), c(Negated, Variable, Value)) :-
@@ -80,10 +82,15 @@ negated_operator(gt, lte).
 
 %% numeric_constraint_holds(+Op, +Left, +Right)
 % Evaluate a comparison between two numbers.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(eq, Left, Right) :- Left =:= Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(neq, Left, Right) :- Left =\= Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(lt, Left, Right) :- Left < Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(lte, Left, Right) :- Left =< Right.
+% mutalog-disable-next-line cut_insert: a comparison has one answer and the operators are distinct
 numeric_constraint_holds(gt, Left, Right) :- Left > Right.
 numeric_constraint_holds(gte, Left, Right) :- Left >= Right.
 
@@ -94,14 +101,18 @@ variable_feasible(Variable, Constraints) :-
 
 % interval(Low, LowKind, High, HighKind, Excluded)
 apply_bound(eq-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo1, LoK1, Hi1, HiK1, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     raise_low(Lo, LoK, Value, closed, Lo1, LoK1),
     lower_high(Hi, HiK, Value, closed, Hi1, HiK1).
 apply_bound(neq-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo, LoK, Hi, HiK, [Value|Ex])).
 apply_bound(lt-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo, LoK, Hi1, HiK1, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     lower_high(Hi, HiK, Value, open, Hi1, HiK1).
 apply_bound(lte-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo, LoK, Hi1, HiK1, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     lower_high(Hi, HiK, Value, closed, Hi1, HiK1).
 apply_bound(gt-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo1, LoK1, Hi, HiK, Ex)) :-
+    % mutalog-disable-next-line cut_insert: raise_low/6 and lower_high/6 are det and the operators are distinct
     raise_low(Lo, LoK, Value, open, Lo1, LoK1).
 apply_bound(gte-Value, interval(Lo, LoK, Hi, HiK, Ex), interval(Lo1, LoK1, Hi, HiK, Ex)) :-
     raise_low(Lo, LoK, Value, closed, Lo1, LoK1).
@@ -116,13 +127,18 @@ lower_high(Hi, _, Value, Kind, Value, Kind) :- Value < Hi, !.
 lower_high(Hi, HiK, Value, Kind, Hi, Kind1) :- Value =:= Hi, !, tighter_kind(HiK, Kind, Kind1).
 lower_high(Hi, HiK, _, _, Hi, HiK).
 
+% mutalog-disable-next-line cut: the second answer, open, only shrinks the interval
 tighter_kind(closed, closed, closed) :- !.
 tighter_kind(_, _, open).
 
 % An unbounded or non-degenerate real interval cannot be emptied by finitely
 % many excluded points.  A degenerate interval is a single closed point.
+% The callers keep only the first answer, so the cuts are not observable.
+% mutalog-disable-next-line cut
 interval_non_empty(interval(ninf, _, _, _, _)) :- !.
+% mutalog-disable-next-line cut
 interval_non_empty(interval(_, _, pinf, _, _)) :- !.
+% mutalog-disable-next-line cut
 interval_non_empty(interval(Lo, _, Hi, _, _)) :- Lo < Hi, !.
 interval_non_empty(interval(Lo, closed, Hi, closed, Excluded)) :-
     Lo =:= Hi,
@@ -131,34 +147,37 @@ interval_non_empty(interval(Lo, closed, Hi, closed, Excluded)) :-
 % Integer variables: every strict or fractional bound is tightened to the
 % nearest admissible integer, so the set is an integer range [Lo, Hi] minus
 % finitely many excluded integers.  An eq bound with a fractional value admits
-% no integer at all.
+% no integer at all, so the fold fails.  The operators are distinct, so the
+% cuts after the heads are not observable.
 integer_variable_feasible(Variable, Constraints) :-
     findall(Op-Value, (member(c(Op, Other, Value), Constraints), Other == Variable), Bounds),
     foldl(apply_integer_bound, Bounds, ibox(ninf, pinf, []), Box),
     integer_box_non_empty(Box).
 
-apply_integer_bound(_, empty, empty) :- !.
-apply_integer_bound(eq-Value, ibox(Lo, Hi, Ex), Box) :- !,
-    (   integral_value(Value, Integer)
-    ->  integer_raise_low(Lo, Integer, Lo1),
-        integer_lower_high(Hi, Integer, Hi1),
-        Box = ibox(Lo1, Hi1, Ex)
-    ;   Box = empty
-    ).
+% mutalog-disable-next-line cut
+apply_integer_bound(eq-Value, ibox(Lo, Hi, Ex), ibox(Lo1, Hi1, Ex)) :- !,
+    integral_value(Value, Integer),
+    integer_raise_low(Lo, Integer, Lo1),
+    integer_lower_high(Hi, Integer, Hi1).
+% mutalog-disable-next-line cut
 apply_integer_bound(neq-Value, ibox(Lo, Hi, Ex), ibox(Lo, Hi, Ex1)) :- !,
     (   integral_value(Value, Integer)
     ->  Ex1 = [Integer|Ex]
     ;   Ex1 = Ex
     ).
+% mutalog-disable-next-line cut
 apply_integer_bound(gt-Value, ibox(Lo, Hi, Ex), ibox(Lo1, Hi, Ex)) :- !,
     Bound is floor(Value) + 1,
     integer_raise_low(Lo, Bound, Lo1).
+% mutalog-disable-next-line cut
 apply_integer_bound(gte-Value, ibox(Lo, Hi, Ex), ibox(Lo1, Hi, Ex)) :- !,
     Bound is ceiling(Value),
     integer_raise_low(Lo, Bound, Lo1).
+% mutalog-disable-next-line cut
 apply_integer_bound(lt-Value, ibox(Lo, Hi, Ex), ibox(Lo, Hi1, Ex)) :- !,
     Bound is ceiling(Value) - 1,
     integer_lower_high(Hi, Bound, Hi1).
+% mutalog-disable-next-line cut
 apply_integer_bound(lte-Value, ibox(Lo, Hi, Ex), ibox(Lo, Hi1, Ex)) :- !,
     Bound is floor(Value),
     integer_lower_high(Hi, Bound, Hi1).
@@ -175,11 +194,13 @@ integer_lower_high(pinf, Bound, Bound) :- !.
 integer_lower_high(Hi, Bound, Hi1) :- Hi1 is min(Hi, Bound).
 
 % An unbounded integer range cannot be emptied by finitely many exclusions.
-integer_box_non_empty(empty) :- !, fail.
+% A range with Lo above Hi has a non-positive size, so it fails the count.
+% The callers keep only the first answer, so the cuts are not observable.
+% mutalog-disable-next-line cut
 integer_box_non_empty(ibox(ninf, _, _)) :- !.
+% mutalog-disable-next-line cut
 integer_box_non_empty(ibox(_, pinf, _)) :- !.
 integer_box_non_empty(ibox(Lo, Hi, Excluded)) :-
-    Lo =< Hi,
     findall(Value, (member(Value, Excluded), Value >= Lo, Value =< Hi), Inside0),
     sort(Inside0, Inside),
     length(Inside, ExcludedCount),