eml-stdlib 0.4.0__py3-none-any.whl

eml_stdlib/ml/rotary_embed.eml

@@ -0,0 +1,64 @@
+// rotary_embed.eml -- Rotary Position Embedding (RoPE) kernel.
+//
+// RoPE applies a 2D rotation to each (x_even, x_odd) pair in the
+// query/key vector at position m. The rotation angle is
+//
+//   theta_i = m / base^(2i/d)
+//
+// where base = 10000 (standard), d is the head dimension, i in
+// [0, d/2). The transformed pair is
+//
+//   x_even' = x_even * cos(theta) - x_odd * sin(theta)
+//   x_odd'  = x_even * sin(theta) + x_odd * cos(theta)
+//
+// Chain order 1 -- one sin, one cos per pair. The dot-product
+// q . k after RoPE encodes the relative position (m - n), which is
+// what the attention layer wants.
+
+module rotary_embed;
+
+const DEFAULT_BASE: Real = 10000.0
+
+// Rotation angle for index i at position m.
+@verify(lean, theorem = "rope_theta_at_zero_position_is_zero")
+fn theta(m: Real, i: Real, d: Real, base: Real) -> Real
+    where chain_order <= 1,
+          domain: d > 0.0 && base > 0.0
+{
+    let exponent = 2.0 * i / d;
+    m / pow(base, exponent)
+}
+
+// Default-base theta.
+@verify(lean, theorem = "rope_default_theta_at_zero_position_is_zero")
+fn theta_default(m: Real, i: Real, d: Real) -> Real
+    where chain_order <= 1,
+          domain: d > 0.0
+{
+    let exponent = 2.0 * i / d;
+    m / pow(DEFAULT_BASE, exponent)
+}
+
+// Rotate one (even, odd) pair.
+@verify(lean, theorem = "rope_rotation_preserves_norm")
+fn rotate_pair_even(x_even: Real, x_odd: Real, theta: Real) -> Real
+    where chain_order <= 1
+{
+    x_even * cos(theta) - x_odd * sin(theta)
+}
+
+@verify(lean, theorem = "rope_rotation_pair_norm_preserved")
+fn rotate_pair_odd(x_even: Real, x_odd: Real, theta: Real) -> Real
+    where chain_order <= 1
+{
+    x_even * sin(theta) + x_odd * cos(theta)
+}
+
+// Pythagorean witness: |rotated|^2 = |x_even|^2 + |x_odd|^2.
+@verify(lean, theorem = "rope_pythagorean_witness")
+fn norm_witness(theta: Real) -> Real
+    where chain_order <= 1
+    ensures (result == 1.0)
+{
+    sin(theta) * sin(theta) + cos(theta) * cos(theta)
+}

eml_stdlib/ml/silu.eml

@@ -0,0 +1,40 @@
+// silu.eml -- SiLU / Swish activation.
+//
+//   silu(x) = x * sigmoid(x) = x / (1 + exp(-x))
+//
+// Same shape and chain-order class as sigmoid; the multiplication
+// by x makes the activation unbounded above, which matches the
+// behaviour modern transformer architectures want.
+
+module silu;
+
+const SILU_X_MAX: Real = 30.0
+
+@verify(lean, theorem = "silu_at_zero_is_zero")
+fn silu(x: Real) -> Real
+    where chain_order <= 1
+    requires (abs(x) < SILU_X_MAX)
+    ensures (result >= -1.0)  // global lower bound is ~-0.278
+{
+    x / (1.0 + exp(-x))
+}
+
+// Beta-Swish variant: x * sigmoid(beta * x).
+@verify(lean, theorem = "swish_at_zero_is_zero")
+fn swish(x: Real, beta: Real) -> Real
+    where chain_order <= 1
+    requires (abs(beta * x) < SILU_X_MAX)
+{
+    x / (1.0 + exp(-beta * x))
+}
+
+// Derivative -- f'(x) = sigmoid(x) + x * sigmoid'(x)
+//                    = sigmoid(x) * (1 + x * (1 - sigmoid(x))).
+@verify(lean, theorem = "silu_derivative_at_zero_is_one_half")
+fn silu_grad(x: Real) -> Real
+    where chain_order <= 1
+    requires (abs(x) < SILU_X_MAX)
+{
+    let s = 1.0 / (1.0 + exp(-x));
+    s + x * s * (1.0 - s)
+}

eml_stdlib/ml/softmax.eml

@@ -0,0 +1,87 @@
+// softmax.eml -- numerically-stable softmax kernels.
+//
+// Softmax over an N-vector requires (a) subtracting the max for
+// numerical stability and (b) reducing across the vector. EML's
+// scalar-kernel surface naturally splits this into three pure
+// gates that the host loop composes:
+//
+//   softmax_shift_exp(logit, max_logit)   per-element exp(x - m)
+//   softmax_normalize(numer, denom_sum)   per-element / sum
+//   softmax_two_logit(a, b)               closed form for N=2
+//
+// The FPGA allocator (Patent #14) maps the per-element gates to
+// SIMD lanes and the reduction to a tree adder; cross-target
+// equivalence (Patent #22) then guarantees the C / Rust / Lean
+// reference matches the Verilog bit-for-bit at IEEE-754
+// rounding.
+
+module softmax;
+
+const SOFTMAX_X_MAX: Real = 30.0
+
+type SoftmaxNumerator = Real where chain_order <= 1
+type SoftmaxValue     = Real where chain_order <= 1
+
+// Per-element exp(x - max) -- the numerically-stable softmax
+// numerator. `max_logit` is the running maximum of the logit
+// vector, supplied by the host (computed in a separate reduce).
+// Subtracting it before exp() guarantees the largest numerator
+// equals 1.0 and the smallest doesn't underflow.
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "softmax_numerator_bounded_by_one")
+fn softmax_shift_exp(logit: Real, max_logit: Real) -> SoftmaxNumerator
+    where chain_order <= 1
+    requires (abs(logit) < SOFTMAX_X_MAX)
+    requires (abs(max_logit) < SOFTMAX_X_MAX)
+    requires (logit <= max_logit)
+    ensures  (result >= 0.0)
+    ensures  (result <= 1.0)
+{
+    exp(logit - max_logit)
+}
+
+// Per-element normaliser. `denom_sum` is the sum of the shifted
+// numerators; supplied by the host's reduction tree.
+@target(fpga, clock_mhz = 400, precision = float32)
+@verify(lean, theorem = "softmax_value_in_unit_interval")
+fn softmax_normalize(numer: Real, denom_sum: Real) -> SoftmaxValue
+    where chain_order <= 0
+    requires (numer >= 0.0)
+    requires (denom_sum > 0.0)
+    requires (numer <= denom_sum)
+    ensures  (result >= 0.0)
+    ensures  (result <= 1.0)
+{
+    numer / denom_sum
+}
+
+// Closed-form softmax for N=2 -- the binary-classifier head.
+// Equivalent to sigmoid(a - b); useful as a sanity-check
+// for the sigmoid-vs-softmax-for-binary debate. Chain order 1.
+@target(fpga, clock_mhz = 250, precision = float32)
+@verify(lean, theorem = "softmax_two_equals_sigmoid_diff")
+fn softmax_two_logit(a: Real, b: Real) -> SoftmaxValue
+    where chain_order <= 1
+    requires (abs(a) < SOFTMAX_X_MAX)
+    requires (abs(b) < SOFTMAX_X_MAX)
+    ensures  (result >= 0.0)
+    ensures  (result <= 1.0)
+{
+    1.0 / (1.0 + exp(b - a))
+}
+
+// Log-sum-exp (LSE) -- stable computation of log(sum exp(x_i)).
+// The host loop accumulates `running_lse` and `next_logit`
+// pair-wise via this gate. Chain order 2 (ln composes through
+// exp). Used as the cross-entropy denominator in transformer
+// language-model heads.
+@target(fpga, clock_mhz = 200, precision = float32)
+@verify(lean, theorem = "log_sum_exp_pair_associative")
+fn log_sum_exp_pair(a: Real, b: Real) -> Real
+    where chain_order <= 2
+    requires (abs(a) < SOFTMAX_X_MAX)
+    requires (abs(b) < SOFTMAX_X_MAX)
+{
+    let m = clamp(a, b, SOFTMAX_X_MAX);
+    m + ln(exp(a - m) + exp(b - m))
+}

eml_stdlib/physics/coulomb.eml

@@ -0,0 +1,48 @@
+// coulomb.eml -- Coulomb's law for electrostatic force / field.
+//
+//   F = k_e * q1 * q2 / r^2
+//   E = k_e * q     / r^2
+//
+// k_e = 8.9875517923e9 N*m^2/C^2 (Coulomb constant).
+// Chain order 0 -- pure rational arithmetic.
+
+module coulomb;
+
+const COULOMB_K: Real = 8.9875517923e9
+const EPS_0:     Real = 8.8541878128e-12
+
+// Force between two point charges separated by r.
+@verify(lean, theorem = "coulomb_force_sign_matches_charge_product")
+fn force(q1: Real, q2: Real, r: Real) -> Real
+    where chain_order <= 0,
+          domain: r > 0.0
+{
+    COULOMB_K * q1 * q2 / (r * r)
+}
+
+// Electric field of a single point charge at distance r.
+@verify(lean, theorem = "coulomb_field_sign_matches_charge")
+fn field(q: Real, r: Real) -> Real
+    where chain_order <= 0,
+          domain: r > 0.0
+{
+    COULOMB_K * q / (r * r)
+}
+
+// Potential energy of a pair of charges at separation r.
+@verify(lean, theorem = "coulomb_potential_energy_sign_matches_charges")
+fn potential_energy(q1: Real, q2: Real, r: Real) -> Real
+    where chain_order <= 0,
+          domain: r > 0.0
+{
+    COULOMB_K * q1 * q2 / r
+}
+
+// Electrostatic potential of a single point charge at distance r.
+@verify(lean, theorem = "coulomb_potential_sign_matches_charge")
+fn potential(q: Real, r: Real) -> Real
+    where chain_order <= 0,
+          domain: r > 0.0
+{
+    COULOMB_K * q / r
+}

eml_stdlib/physics/damped_oscillator.eml

@@ -0,0 +1,20 @@
+// damped_wave.eml -- exp * sin, the chain-2 archetype.
+//
+//   y(t) = exp(-zeta * t) * sin(omega * t)
+//
+// The bedrock damped oscillation. Two transcendentals nested
+// over polynomial arguments -- chain order 2. This shape
+// describes a settling spring, a reverb tail, a relaxation
+// curve, and the impulse response of a second-order linear
+// system.
+
+module damped_wave;
+
+fn damped_wave(zeta: Real, omega: Real, t: Real) -> Real
+    where chain_order <= 2
+    requires (zeta  >= 0.0)
+    requires (omega >= 0.0)
+    requires (t     >= 0.0)
+{
+    exp(-zeta * t) * sin(omega * t)
+}

eml_stdlib/physics/diffusion.eml

@@ -0,0 +1,45 @@
+// diffusion.eml -- 1-D diffusion (heat / mass) equation snapshot.
+//
+//   c(x, t) = (M / sqrt(4*pi*D*t)) * exp(-x^2 / (4*D*t))
+//
+// Closed-form Gaussian solution to the diffusion equation
+//   dc/dt = D * d^2c/dx^2
+// for an initial impulse of mass M at the origin. Chain order 1.
+// At t = 0 the solution is a delta function -- callers that need
+// the impulse should use the Fick steady-state form instead.
+
+module diffusion;
+
+const PI:          Real = 3.141592653589793
+const SQRT_4_PI:   Real = 3.5449077018110318
+
+@verify(lean, theorem = "diffusion_concentration_positive_for_finite_time")
+fn concentration(mass: Real, diffusivity: Real, x: Real, t: Real) -> Real
+    where chain_order <= 1,
+          domain: t > 0.0 && diffusivity > 0.0
+    requires (mass > 0.0)
+    ensures (result > 0.0)
+{
+    let four_dt = 4.0 * diffusivity * t;
+    let prefactor = mass / sqrt(PI * four_dt);
+    prefactor * exp(-x * x / four_dt)
+}
+
+// Standard deviation of the diffusion blob at time t: sigma = sqrt(2*D*t).
+@verify(lean, theorem = "diffusion_sigma_positive_for_finite_time")
+fn sigma(diffusivity: Real, t: Real) -> Real
+    where chain_order <= 1,
+          domain: t > 0.0 && diffusivity > 0.0
+    ensures (result > 0.0)
+{
+    sqrt(2.0 * diffusivity * t)
+}
+
+// Fick's first law: flux = -D * dc/dx (steady-state form).
+@verify(lean, theorem = "fick_flux_sign_opposes_gradient")
+fn fick_first_law(diffusivity: Real, gradient: Real) -> Real
+    where chain_order <= 0,
+          domain: diffusivity > 0.0
+{
+    -diffusivity * gradient
+}

eml_stdlib/physics/gravity.eml

@@ -0,0 +1,60 @@
+// gravity.eml -- two gravity models for game physics.
+//
+// Newtonian inverse-square gravity is the right model for orbital
+// games (Kerbal-class, space sims, asteroid simulators). Surface
+// (uniform / "constant-g") gravity is the right model for platformers
+// and most ground-based games where the planet is "flat" at game
+// scale. Both kernels are provided so a hybrid game (rocket
+// launch + planet surface) can switch.
+//
+// Newton:    a(r) = G * M / r^2          (vector along -r-hat)
+// Surface:   a    = -g                   (constant)
+//
+// drift_risk LOW. Sibling to projectile.eml (which uses
+// surface_gravity_acceleration as input) and bounce.eml.
+
+module gravity;
+
+const ZERO:        Real = 0.0
+const ONE:         Real = 1.0
+const TINY:        Real = 1.0e-9
+
+const G_NEWTON:    Real = 6.6743e-11    // N m^2 / kg^2
+const M_EARTH:     Real = 5.972e24      // kg
+const R_EARTH:     Real = 6.371e6       // m
+const R_MIN:       Real = 1.0e3         // 1 km floor (avoid singularity)
+const R_MAX:       Real = 1.0e12        // 1 Tm cap (outer solar system)
+const M_MAX:       Real = 2.0e30        // ~ solar mass cap
+const G_SURFACE_MAX: Real = 100.0       // jovian-grav cap
+
+type Accel = Real where chain_order <= 0
+
+// Newtonian gravitational acceleration magnitude at distance r
+// from a point mass M. Chain order 0 (rational).
+@target(fpga, clock_mhz = 500, precision = float32)
+@verify(lean, theorem = "newtonian_gravity_inverse_square")
+fn newtonian_acceleration(mass: Real, r: Real) -> Accel
+    where chain_order <= 0
+    requires (mass >= ZERO)
+    requires (mass <= M_MAX)
+    requires (r >= R_MIN)
+    requires (r <= R_MAX)
+    ensures  (result >= ZERO)
+{
+    G_NEWTON * mass / (r * r + TINY)
+}
+
+// Per-frame velocity update under uniform downward gravity. Chain
+// order 0. Most platformer / FPS engines use this -- the planet
+// is treated as flat at game scale and `g` is a tunable.
+@target(fpga, clock_mhz = 500, precision = float32)
+fn surface_gravity_step(v_y: Real, g: Real, dt: Real) -> Real
+    where chain_order <= 0
+    requires (abs(v_y) <= 1.0e4)
+    requires (g >= ZERO)
+    requires (g <= G_SURFACE_MAX)
+    requires (dt >= 1.0e-5)
+    requires (dt <= 0.1)
+{
+    v_y - g * dt
+}

eml_stdlib/physics/hooke.eml

@@ -0,0 +1,56 @@
+// hooke.eml -- Hooke's law for springs and elastic media.
+//
+//   F = -k * x        (restoring force)
+//   U = (1/2) * k * x^2  (stored energy)
+//
+// Linear elastic regime only; for stress/strain Mises-yield-style
+// extensions see the construction industry kernels.
+
+module hooke;
+
+@verify(lean, theorem = "hooke_force_sign_opposes_displacement")
+fn force(stiffness: Real, displacement: Real) -> Real
+    where chain_order <= 0,
+          domain: stiffness > 0.0
+{
+    -stiffness * displacement
+}
+
+@verify(lean, theorem = "hooke_energy_nonneg")
+fn potential_energy(stiffness: Real, displacement: Real) -> Real
+    where chain_order <= 0,
+          domain: stiffness > 0.0
+    ensures (result >= 0.0)
+{
+    0.5 * stiffness * displacement * displacement
+}
+
+// Series stiffness of two springs.
+@verify(lean, theorem = "hooke_series_stiffness_positive")
+fn series_stiffness(k1: Real, k2: Real) -> Real
+    where chain_order <= 0,
+          domain: k1 > 0.0 && k2 > 0.0
+    ensures (result > 0.0)
+{
+    (k1 * k2) / (k1 + k2)
+}
+
+// Parallel stiffness of two springs.
+@verify(lean, theorem = "hooke_parallel_stiffness_positive")
+fn parallel_stiffness(k1: Real, k2: Real) -> Real
+    where chain_order <= 0,
+          domain: k1 > 0.0 && k2 > 0.0
+    ensures (result > 0.0)
+{
+    k1 + k2
+}
+
+// Natural angular frequency of a mass on a spring: omega = sqrt(k/m).
+@verify(lean, theorem = "hooke_omega_positive")
+fn natural_frequency(stiffness: Real, mass: Real) -> Real
+    where chain_order <= 1,
+          domain: stiffness > 0.0 && mass > 0.0
+    ensures (result > 0.0)
+{
+    sqrt(stiffness / mass)
+}

eml_stdlib/physics/navier_stokes_1d.eml

@@ -0,0 +1,57 @@
+// navier_stokes_1d.eml -- 1-D incompressible Navier-Stokes step.
+//
+// Simplified to the momentum-only form on a 1-D pipe:
+//
+//   du/dt + u * du/dx = -(1/rho) * dp/dx + nu * d^2u/dx^2
+//
+// This module ships the right-hand-side terms separately so users
+// can compose explicit, implicit, or semi-Lagrangian time steppers
+// downstream. Chain order 0 throughout.
+
+module navier_stokes_1d;
+
+// Pressure-gradient acceleration term.
+@verify(lean, theorem = "ns1d_pressure_term_sign_opposes_gradient")
+fn pressure_term(density: Real, dp_dx: Real) -> Real
+    where chain_order <= 0,
+          domain: density > 0.0
+{
+    -dp_dx / density
+}
+
+// Viscous (diffusive) term.
+@verify(lean, theorem = "ns1d_viscous_term_proportional_to_d2u_dx2")
+fn viscous_term(viscosity: Real, d2u_dx2: Real) -> Real
+    where chain_order <= 0,
+          domain: viscosity >= 0.0
+{
+    viscosity * d2u_dx2
+}
+
+// Convective (advective) term.
+@verify(lean, theorem = "ns1d_convective_term_signed")
+fn convective_term(u: Real, du_dx: Real) -> Real
+    where chain_order <= 0
+{
+    -u * du_dx
+}
+
+// Full RHS of the momentum equation.
+fn rhs(u: Real, du_dx: Real, d2u_dx2: Real,
+       density: Real, dp_dx: Real, viscosity: Real) -> Real
+    where chain_order <= 0,
+          domain: density > 0.0 && viscosity >= 0.0
+{
+    -u * du_dx - dp_dx / density + viscosity * d2u_dx2
+}
+
+// Reynolds number: Re = u * L / nu. Determines laminar/turbulent
+// regime; useful invariant for caller's adaptive time step.
+@verify(lean, theorem = "reynolds_nonneg")
+fn reynolds(velocity: Real, length: Real, viscosity: Real) -> Real
+    where chain_order <= 0,
+          domain: viscosity > 0.0
+    requires (length > 0.0)
+{
+    velocity * length / viscosity
+}

eml_stdlib/physics/planck_radiation.eml

@@ -0,0 +1,77 @@
+// planck_radiation.eml -- Planck blackbody spectral radiance.
+//
+// Planck's law for the spectral radiance of a blackbody at
+// temperature T:
+//
+//   B(lambda, T) = (2*h*c^2 / lambda^5) * 1 / (exp(h*c/(lambda*k*T)) - 1)
+//
+// where h is Planck's constant, c is the speed of light, k is
+// Boltzmann's constant. Used in radiometry, IR remote sensing,
+// astrophysics, and thermal-imaging calibration.
+//
+// Chain order 1 (single exp). Companion of stefan_boltzmann.eml
+// (which is the integral of B over all wavelengths).
+
+module planck_radiation;
+
+const HC:           Real = 1.986445857e-25     // h*c, J*m
+const HC_OVER_K:    Real = 0.014387768775039337 // h*c/k, m*K
+const TWO_HC2:      Real = 1.191042869e-16     // 2*h*c^2, W*m^4*sr^-1
+const LAMBDA_MIN:   Real = 1.0e-9              // 1 nm UV
+const LAMBDA_MAX:   Real = 1.0e-3              // 1 mm far-IR
+const T_MIN:        Real = 1.0
+const T_MAX:        Real = 1.0e5
+
+type SpectralRadiance = Real where chain_order <= 1
+
+@target(fpga, clock_mhz = 100, precision = float64)
+@verify(lean, theorem = "planck_radiance_increases_with_temperature")
+fn spectral_radiance(wavelength_m: Real, temperature_k: Real) -> SpectralRadiance
+    where chain_order <= 1
+    requires (wavelength_m >= LAMBDA_MIN)
+    requires (wavelength_m <= LAMBDA_MAX)
+    requires (temperature_k >= T_MIN)
+    requires (temperature_k <= T_MAX)
+    ensures  (result >= 0.0)
+{
+    let lambda5 = wavelength_m * wavelength_m * wavelength_m
+                * wavelength_m * wavelength_m;
+    let prefactor = TWO_HC2 / lambda5;
+    let exponent = HC_OVER_K / (wavelength_m * temperature_k);
+    prefactor / (exp(exponent) - 1.0)
+}
+
+// Wien displacement: lambda_max * T = b. Reused from
+// stefan_boltzmann; here for completeness in this physics
+// kernel pair.
+@target(fpga, clock_mhz = 500, precision = float64)
+@verify(lean, theorem = "wien_constant_inversely_proportional_to_T")
+fn wien_lambda_max(temperature_k: Real) -> Real
+    where chain_order <= 0
+    requires (temperature_k >= T_MIN)
+    requires (temperature_k <= T_MAX)
+    ensures  (result >= 0.0)
+{
+    0.002897771955 / temperature_k
+}
+
+// Rayleigh-Jeans long-wavelength approximation:
+//   B(lambda, T) ~ 2*c*k*T / lambda^4
+// Valid when h*c << lambda*k*T (radio / mm-wave radiometry).
+// Chain order 0 (no exp).
+@target(fpga, clock_mhz = 500, precision = float64)
+@verify(lean, theorem = "rayleigh_jeans_underestimates_at_short_wavelength")
+fn rayleigh_jeans_radiance(
+    wavelength_m: Real,
+    temperature_k: Real,
+) -> SpectralRadiance
+    where chain_order <= 0
+    requires (wavelength_m >= LAMBDA_MIN)
+    requires (wavelength_m <= LAMBDA_MAX)
+    requires (temperature_k >= T_MIN)
+    requires (temperature_k <= T_MAX)
+    ensures  (result >= 0.0)
+{
+    let lambda4 = wavelength_m * wavelength_m * wavelength_m * wavelength_m;
+    2.0 * 299792458.0 * 1.380649e-23 * temperature_k / lambda4
+}

eml_stdlib/physics/stefan_boltzmann.eml

@@ -0,0 +1,75 @@
+// stefan_boltzmann.eml -- blackbody radiative flux.
+//
+// The Stefan-Boltzmann law:
+//
+//   j = epsilon * sigma * T^4
+//
+// where:
+//   sigma   = 5.670374419e-8 W m^-2 K^-4 (Stefan-Boltzmann constant)
+//   epsilon = surface emissivity (0..1)
+//   T       = absolute temperature (K)
+//
+// Chain order 1 (single pow). Used in radiative-balance climate
+// models, spacecraft thermal control, IR-camera calibration,
+// and as the upper-bound term in atmospheric energy budgets.
+
+module stefan_boltzmann;
+
+const SIGMA_SB:    Real = 5.670374419e-8
+const T_MIN:       Real = 1.0
+const T_MAX:       Real = 6000.0
+const EPS_MIN:     Real = 0.0
+const EPS_MAX:     Real = 1.0
+
+type RadiativeFlux = Real where chain_order <= 1
+
+@target(fpga, clock_mhz = 200, precision = float64)
+@verify(lean, theorem = "stefan_boltzmann_monotone_in_T")
+fn radiative_flux(emissivity: Real, temperature_k: Real) -> RadiativeFlux
+    where chain_order <= 1
+    requires (emissivity >= EPS_MIN)
+    requires (emissivity <= EPS_MAX)
+    requires (temperature_k >= T_MIN)
+    requires (temperature_k <= T_MAX)
+    ensures  (result >= 0.0)
+{
+    emissivity * SIGMA_SB * pow(temperature_k, 4.0)
+}
+
+// Net radiative exchange between a surface at T_s and an
+// environment at T_env, both treated as graybodies. Chain
+// order 1 (two pow calls but the same exponent -- SuperBEST
+// can fuse into a single pow on the difference of fourth
+// powers if it sees the pattern).
+@target(fpga, clock_mhz = 200, precision = float64)
+@verify(lean, theorem = "net_exchange_zero_at_equilibrium")
+fn net_exchange(
+    emissivity: Real,
+    surface_t: Real,
+    ambient_t: Real,
+) -> RadiativeFlux
+    where chain_order <= 1
+    requires (emissivity >= EPS_MIN)
+    requires (emissivity <= EPS_MAX)
+    requires (surface_t >= T_MIN)
+    requires (surface_t <= T_MAX)
+    requires (ambient_t >= T_MIN)
+    requires (ambient_t <= T_MAX)
+{
+    emissivity * SIGMA_SB * (pow(surface_t, 4.0) - pow(ambient_t, 4.0))
+}
+
+// Wien's displacement law -- peak wavelength of a blackbody
+// at temperature T. lambda_max = b / T with b ≈ 2.898e-3 m·K.
+// Chain order 0 (pure division). Companion to Stefan-Boltzmann
+// for diagnosing the spectral peak from surface temperature.
+@target(fpga, clock_mhz = 500, precision = float64)
+@verify(lean, theorem = "wien_inversely_proportional_to_T")
+fn wien_peak_wavelength(temperature_k: Real) -> Real
+    where chain_order <= 0
+    requires (temperature_k >= T_MIN)
+    requires (temperature_k <= T_MAX)
+    ensures  (result > 0.0)
+{
+    0.002897771955 / temperature_k
+}

eml_stdlib/physics/wave_propagation.eml

@@ -0,0 +1,52 @@
+// wave_propagation.eml -- 1-D linear wave equation snapshot.
+//
+//   u(x, t) = A * sin(k*x - omega*t + phi)
+//
+// k = 2*pi / lambda, omega = 2*pi*f, c = omega / k.
+//
+// Chain order 1 -- one transcendental, linear argument. Closed
+// boundary identities: u(x, 0) at phi=0 equals A*sin(k*x), and the
+// wave speed is the constant ratio omega/k.
+
+module wave_propagation;
+
+const TWO_PI: Real = 6.283185307179586
+
+@verify(lean, theorem = "wave_amplitude_in_unit_interval")
+fn wave(amplitude: Real, k: Real, omega: Real, phi: Real,
+        x: Real, t: Real) -> Real
+    where chain_order <= 1
+    ensures (abs(result) <= abs(amplitude))
+{
+    amplitude * sin(k * x - omega * t + phi)
+}
+
+// Wavelength from wavenumber k = 2*pi / lambda.
+@verify(lean, theorem = "wavelength_positive")
+fn wavelength(k: Real) -> Real
+    where chain_order <= 0,
+          domain: k > 0.0
+    ensures (result > 0.0)
+{
+    TWO_PI / k
+}
+
+// Frequency from angular frequency omega = 2*pi * f.
+@verify(lean, theorem = "frequency_nonneg")
+fn frequency(omega: Real) -> Real
+    where chain_order <= 0,
+          domain: omega >= 0.0
+    ensures (result >= 0.0)
+{
+    omega / TWO_PI
+}
+
+// Phase velocity c = omega / k.
+@verify(lean, theorem = "phase_velocity_positive")
+fn phase_velocity(omega: Real, k: Real) -> Real
+    where chain_order <= 0,
+          domain: k > 0.0 && omega > 0.0
+    ensures (result > 0.0)
+{
+    omega / k
+}