unicode-fol-kit 0.7.0__tar.gz → 0.8.0__tar.gz

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/CHANGELOG.md

@@ -5,6 +5,79 @@ loosely based on [Keep a Changelog](https://keepachangelog.com/). Versioning is
 semantic, but the project is pre-1.0 (alpha): a **minor** release may contain
 breaking changes.
 
+## [0.8.0] - 2026-06-28
+
+### Added
+
+- **Run a local Isabelle to actually *prove* the modal embeddings — `unicode_fol_kit.hol.isabelle_runner`.**
+  The `hol` exporters only *emit*; this opt-in module turns "emit" into "proven / refuted" when an
+  Isabelle/HOL install is present. `isabelle_decide_modal(φ, frame=…, mode=…)` decides validity by a
+  two-step procedure, read off the build's exit code: (1) emit the lemma with a proof battery that
+  brings the frame/domain axioms into scope (`using … by (blast | force | … | meson … | metis …)`) — a
+  successful `isabelle build` means **VALID**; (2) otherwise emit `nitpick[expect = genuine]`, whose
+  build succeeds **iff** a genuine finite counter-model exists — that means **INVALID**; (3) otherwise
+  **UNKNOWN**. Sound (Isabelle's kernel certifies the proof; nitpick reports only genuine
+  counter-models) and, necessarily, incomplete. The verdict is validated *differentially* against an
+  independent brute-force Kripke oracle (`satisfies_modal`) across K/T/S4/S5 in the test suite.
+  - `find_isabelle` / `isabelle_available` locate an install (explicit path → `UFK_ISABELLE_HOME` /
+    `ISABELLE_HOME` → `isabelle` on `PATH` → a light scan); `check_theory(text, name)` builds any
+    self-contained theory; `ModalVerdict` / `BuildResult` / `IsabelleInstall` carry the results.
+  - **Linux/macOS is the primary path** — `isabelle` is invoked directly. **Windows** is also
+    supported: the build is additionally routed through Isabelle's bundled Cygwin (Windows→`/cygdrive`
+    path translation, launcher exec-bit fixup, `bin` on `PATH`). No install path is hard-coded —
+    installations are discovered generically. Absent Isabelle raises a clear `IsabelleNotAvailable`;
+    the live tests skip.
+  - All re-exported at the package top level.
+
+### Fixed
+
+- **`to_isabelle_modal` emitted proofs could not discharge axiom-dependent validities.** A bare
+  `axiomatization where r_refl: …` fact is not in Isabelle's default claset, so `by blast` / `by auto`
+  / `by (metis …)` could not see it: every validity that *depends* on a frame/domain axiom (T, S4, S5,
+  KD, KD45, the temporal closure, a domain regime) failed to prove even though the formula is valid and
+  the theory sound (only the pure-K fragment, like the K axiom, went through). The `by`-style tactics
+  now emit `using <frame/domain axioms> by …`. New `modal_axiom_names(φ, …)` exposes the axioms in
+  scope, and `isabelle_modal_theory(…, proof=…)` accepts an explicit proof override.
+- **`to_isabelle_k3lp` / `to_isabelle_k3lp_entailment` emitted a non-discharging proof.**
+  `by (simp add: des_def)` does **not** close the validity lemma — `simp` cannot reduce `kneg v` /
+  `kor v …` while the quantified truth-value `v` is abstract (e.g. the LP-valid `p ∨ ¬p` failed). The
+  `∀` (valid) form is now discharged by exhausting each variable's three `tv` constructors
+  (`case_tac` + `simp_all`); the `∃` (refutation) form by supplying the counter-valuation as `rule exI`
+  witnesses computed at emit time. Every form is verified to build in real Isabelle.
+
+### Changed
+
+- **`to_isabelle_intuitionistic` now emits a real, Isabelle-checked proof for valid formulas.** The
+  proof is verdict-dependent: an intuitionistically valid formula gets `using r_refl r_trans by
+  (metis … | meson … | blast | auto)` that Isabelle discharges; a non-valid one is left `oops` (loads,
+  claims nothing — see `int_countermodel`). Previously the lemma was always `oops`. The verdict is
+  taken from the **decidable** S4 oracle `gmt_is_s4_valid` (Z3 on the GMT→S4 translation), *not* from
+  `int_valid`'s default 3-world bound — which is incomplete (IPL's finite-model bound grows with the
+  formula, so a non-theorem like `(p→q)∨(q→r)∨(r→p)` would otherwise be mis-emitted with a real
+  proof that cannot close).
+
+### Audit hardening
+
+A multi-agent adversarial soundness audit of the new subsystem confirmed five issues (no false
+*VALID* is possible — Isabelle's kernel rejects a proof of a false goal), all fixed and re-checked
+against a live Isabelle:
+
+- **Intuitionistic proof gated on the decidable oracle** (above) — was a real proof emitted for an
+  IPL-*invalid* formula (theory then failed to build).
+- **Atom-name collisions in the intuitionistic export.** An atom named `r` (or `w`/`v`/`u`) collided
+  with the accessibility relation / frame-axiom variables, emitting a duplicate `consts r` (or an
+  ill-typed axiom) so the theory never loaded — even for the valid `r → r`. `_isa_atom_name` now
+  reserves the structural identifiers and de-collides (`r` → `p_r`).
+- **Temporal closure now pinned faithfully.** When `Always`/`Eventually` co-occur with `Next`, the
+  emitted henceforth relation `t` is now forced to equal the reflexive-transitive closure of the
+  one-step `n` (`t ⊆ rtranclp n`, with the existing `t_refl`/`t_trans`/`n_in_t` giving the converse),
+  matching `satisfies_modal`. Previously `t` could be any refl-trans superset of `n`, so a
+  `satisfies_modal`-valid temporal induction `(p ∧ G(p→Xp)) → Gp` was spuriously refuted (a false
+  *INVALID*); it is now never refuted (UNKNOWN — the closure fragment is a documented approximation).
+- **`ModalVerdict.infra_error`.** An `UNKNOWN` whose build failed for an infrastructure reason
+  (syntax / JVM / timeout / …) now carries a short signature, so a broken theory or environment is no
+  longer indistinguishable from honest incompleteness. Never changes the verdict.
+
 ## [0.7.0] - 2026-06-28
 
 ### Added

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unicode-fol-kit
-Version: 0.7.0
+Version: 0.8.0
 Summary: Parser and toolkit for first-order logic formulas using Unicode operators
 Project-URL: Repository, https://github.com/fvossel/unicode-fol-kit
 Project-URL: Issues, https://github.com/fvossel/unicode-fol-kit/issues
@@ -1095,7 +1095,7 @@ thf = to_thf_modal(BARCAN, mode="constant", frame="S5")
 
 ## Higher-order proving: Isabelle / THF exporters (the `hol` subpackage)
 
-Beyond the first-order embedding above, `unicode_fol_kit.hol` emits **Benzmüller-style shallow embeddings into higher-order logic** for *all* the non-fuzzy logics — as complete, self-contained problem files for an external prover (Leo-III / Satallax on TPTP **THF**, or Isabelle/HOL theories for Sledgehammer). As everywhere in the kit it **emits**; it does not run a prover — and it cannot decide everything: first-order modal logic, FOL, and SOL are undecidable / not even semi-decidable, so a successful emission means *"here is a sound problem a prover may discharge"*, never *"decided"*. (The propositional fragments — K3/LP, modal K/T/S4/S5 — are decidable, but these exporters target the general case.)
+Beyond the first-order embedding above, `unicode_fol_kit.hol` emits **Benzmüller-style shallow embeddings into higher-order logic** for *all* the non-fuzzy logics — as complete, self-contained problem files for an external prover (Leo-III / Satallax on TPTP **THF**, or Isabelle/HOL theories for Sledgehammer). The exporters **emit**; they do not themselves run a prover — and cannot decide everything: first-order modal logic, FOL, and SOL are undecidable / not even semi-decidable, so a successful emission means *"here is a sound problem a prover may discharge"*, never *"decided"*. (The propositional fragments — K3/LP, modal K/T/S4/S5 — are decidable, but these exporters target the general case.) If you *do* have Isabelle installed, the opt-in [`isabelle_runner`](#actually-running-it-the-isabelle-runner) runs it for you and reads back a real verdict.
 
 ```python
 from unicode_fol_kit import MSFLParser
@@ -1120,6 +1120,33 @@ print(to_thf_modal_full(f))    # a complete TPTP THF problem; rk is AGENT-indexe
 
 Each embedding is faithful to its in-toolkit ground-truth oracle (`satisfies_modal`, `kleene_value`, `satisfies_so`, `int_valid`), verified by an adversarial differential audit. Equality `=` / `≠` is an **uninterpreted, world-relativized** predicate throughout (not primitive HOL identity), consistently across every exporter.
 
+### Actually running it: the Isabelle runner
+
+If a local **Isabelle/HOL** is installed, `unicode_fol_kit.hol.isabelle_runner` turns *emit* into *proven / refuted* — the toolkit writes the embedding to a scratch session, runs `isabelle build`, and reads the verdict off the build. It is **opt-in**: with no Isabelle present everything else still works and these calls raise a clear `IsabelleNotAvailable` (the live tests skip).
+
+```python
+# doctest: +SKIP  — needs a local Isabelle install
+from unicode_fol_kit import MSFLParser, isabelle_available, isabelle_decide_modal
+
+parse = MSFLParser(modal=True).parse
+print(isabelle_available())                        # True if Isabelle was located
+
+print(isabelle_decide_modal(parse("□P → P"), frame="K"))    # ModalVerdict[invalid, frame=K, …]
+print(isabelle_decide_modal(parse("□P → P"), frame="T"))    # ModalVerdict[valid (by prove-battery), …]
+print(isabelle_decide_modal(parse("□P → □□P"), frame="S4"))  # ModalVerdict[valid …]
+```
+
+`isabelle_decide_modal` decides validity (for the chosen `frame` / `mode`) in two steps, read off the build's exit code:
+
+1. **Prove** — emit the lemma with a proof battery that brings the frame/domain axioms into scope (`using <axioms> by (blast | force | fastforce | auto | meson … | metis …)`). A successful `isabelle build` ⇒ **VALID**.
+2. **Refute** — otherwise emit `nitpick[expect = genuine]`, whose build succeeds **iff** Isabelle finds a genuine finite counter-model ⇒ **INVALID**.
+3. Otherwise ⇒ **UNKNOWN** (expected — first-order modal logic is undecidable).
+
+This is **sound** (Isabelle's kernel certifies the proof; nitpick reports only *genuine* counter-models) and necessarily **incomplete**; `UNKNOWN` is a real outcome, not a failure. The verdict is validated *differentially* against an independent brute-force Kripke oracle (`satisfies_modal`) across K/T/S4/S5 in the test suite.
+
+- **Locating Isabelle.** `find_isabelle()` looks at an explicit path, then `UFK_ISABELLE_HOME` / `ISABELLE_HOME`, then `isabelle` on `PATH`, then a light scan of standard install locations (no path is hard-coded); `isabelle_available()` is the cheap predicate. **Linux/macOS is the primary path** — `isabelle` is invoked directly; **Windows** is also supported, with the build routed through Isabelle's bundled Cygwin automatically (path translation + launcher exec-bit fixup).
+- **Any theory.** `check_theory(theory_text, theory_name)` builds an arbitrary self-contained theory and returns a `BuildResult` — used internally, and handy for the non-modal exporters (`to_isabelle_fol`, `to_isabelle_k3lp`, `to_isabelle_intuitionistic` …), whose emitted proofs are themselves built against real Isabelle in the test suite.
+
 ## Many-valued logic (Kleene K3 / Priest LP)
 
 `kleene_value()` evaluates a classical formula over the three truth values **0 (false)**, **½ (undefined / both)**, and **1 (true)** using the strong Kleene tables (`¬x = 1−x`, `∧ = min`, `∨ = max`, `→ = max(1−x, y)`). Validity, satisfiability, and entailment are decided by enumeration under a chosen set of **designated** values — Kleene's **K3** designates `{1}`, Priest's paraconsistent **LP** designates `{½, 1}`:

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/README.md

@@ -1071,7 +1071,7 @@ thf = to_thf_modal(BARCAN, mode="constant", frame="S5")
 
 ## Higher-order proving: Isabelle / THF exporters (the `hol` subpackage)
 
-Beyond the first-order embedding above, `unicode_fol_kit.hol` emits **Benzmüller-style shallow embeddings into higher-order logic** for *all* the non-fuzzy logics — as complete, self-contained problem files for an external prover (Leo-III / Satallax on TPTP **THF**, or Isabelle/HOL theories for Sledgehammer). As everywhere in the kit it **emits**; it does not run a prover — and it cannot decide everything: first-order modal logic, FOL, and SOL are undecidable / not even semi-decidable, so a successful emission means *"here is a sound problem a prover may discharge"*, never *"decided"*. (The propositional fragments — K3/LP, modal K/T/S4/S5 — are decidable, but these exporters target the general case.)
+Beyond the first-order embedding above, `unicode_fol_kit.hol` emits **Benzmüller-style shallow embeddings into higher-order logic** for *all* the non-fuzzy logics — as complete, self-contained problem files for an external prover (Leo-III / Satallax on TPTP **THF**, or Isabelle/HOL theories for Sledgehammer). The exporters **emit**; they do not themselves run a prover — and cannot decide everything: first-order modal logic, FOL, and SOL are undecidable / not even semi-decidable, so a successful emission means *"here is a sound problem a prover may discharge"*, never *"decided"*. (The propositional fragments — K3/LP, modal K/T/S4/S5 — are decidable, but these exporters target the general case.) If you *do* have Isabelle installed, the opt-in [`isabelle_runner`](#actually-running-it-the-isabelle-runner) runs it for you and reads back a real verdict.
 
 ```python
 from unicode_fol_kit import MSFLParser
@@ -1096,6 +1096,33 @@ print(to_thf_modal_full(f))    # a complete TPTP THF problem; rk is AGENT-indexe
 
 Each embedding is faithful to its in-toolkit ground-truth oracle (`satisfies_modal`, `kleene_value`, `satisfies_so`, `int_valid`), verified by an adversarial differential audit. Equality `=` / `≠` is an **uninterpreted, world-relativized** predicate throughout (not primitive HOL identity), consistently across every exporter.
 
+### Actually running it: the Isabelle runner
+
+If a local **Isabelle/HOL** is installed, `unicode_fol_kit.hol.isabelle_runner` turns *emit* into *proven / refuted* — the toolkit writes the embedding to a scratch session, runs `isabelle build`, and reads the verdict off the build. It is **opt-in**: with no Isabelle present everything else still works and these calls raise a clear `IsabelleNotAvailable` (the live tests skip).
+
+```python
+# doctest: +SKIP  — needs a local Isabelle install
+from unicode_fol_kit import MSFLParser, isabelle_available, isabelle_decide_modal
+
+parse = MSFLParser(modal=True).parse
+print(isabelle_available())                        # True if Isabelle was located
+
+print(isabelle_decide_modal(parse("□P → P"), frame="K"))    # ModalVerdict[invalid, frame=K, …]
+print(isabelle_decide_modal(parse("□P → P"), frame="T"))    # ModalVerdict[valid (by prove-battery), …]
+print(isabelle_decide_modal(parse("□P → □□P"), frame="S4"))  # ModalVerdict[valid …]
+```
+
+`isabelle_decide_modal` decides validity (for the chosen `frame` / `mode`) in two steps, read off the build's exit code:
+
+1. **Prove** — emit the lemma with a proof battery that brings the frame/domain axioms into scope (`using <axioms> by (blast | force | fastforce | auto | meson … | metis …)`). A successful `isabelle build` ⇒ **VALID**.
+2. **Refute** — otherwise emit `nitpick[expect = genuine]`, whose build succeeds **iff** Isabelle finds a genuine finite counter-model ⇒ **INVALID**.
+3. Otherwise ⇒ **UNKNOWN** (expected — first-order modal logic is undecidable).
+
+This is **sound** (Isabelle's kernel certifies the proof; nitpick reports only *genuine* counter-models) and necessarily **incomplete**; `UNKNOWN` is a real outcome, not a failure. The verdict is validated *differentially* against an independent brute-force Kripke oracle (`satisfies_modal`) across K/T/S4/S5 in the test suite.
+
+- **Locating Isabelle.** `find_isabelle()` looks at an explicit path, then `UFK_ISABELLE_HOME` / `ISABELLE_HOME`, then `isabelle` on `PATH`, then a light scan of standard install locations (no path is hard-coded); `isabelle_available()` is the cheap predicate. **Linux/macOS is the primary path** — `isabelle` is invoked directly; **Windows** is also supported, with the build routed through Isabelle's bundled Cygwin automatically (path translation + launcher exec-bit fixup).
+- **Any theory.** `check_theory(theory_text, theory_name)` builds an arbitrary self-contained theory and returns a `BuildResult` — used internally, and handy for the non-modal exporters (`to_isabelle_fol`, `to_isabelle_k3lp`, `to_isabelle_intuitionistic` …), whose emitted proofs are themselves built against real Isabelle in the test suite.
+
 ## Many-valued logic (Kleene K3 / Priest LP)
 
 `kleene_value()` evaluates a classical formula over the three truth values **0 (false)**, **½ (undefined / both)**, and **1 (true)** using the strong Kleene tables (`¬x = 1−x`, `∧ = min`, `∨ = max`, `→ = max(1−x, y)`). Validity, satisfiability, and entailment are decided by enumeration under a chosen set of **designated** values — Kleene's **K3** designates `{1}`, Priest's paraconsistent **LP** designates `{½, 1}`:

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "unicode-fol-kit"
-version = "0.7.0"
+version = "0.8.0"
 description = "Parser and toolkit for first-order logic formulas using Unicode operators"
 readme = "README.md"
 license = { text = "MIT" }

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/unicode_fol_kit/__init__.py

@@ -63,8 +63,13 @@ from .eval import (
     validate, is_wellformed, validate_text, ValidationReport,
     formulas_are_identical, match_predicates, formulas_are_matched_identical,
 )
+from .hol import (
+    find_isabelle, isabelle_available, isabelle_decide_modal, check_theory,
+    IsabelleInstall, IsabelleNotAvailable, BuildResult, ModalVerdict,
+    modal_axiom_names,
+)
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"
 
 __all__ = [
     "MSFLParser",
@@ -97,6 +102,9 @@ __all__ = [
     "parse_prover9",
     "qml_translate", "qml_is_valid", "qml_equivalent",
     "to_thf_modal", "to_isabelle_modal", "BARCAN", "CONVERSE_BARCAN",
+    "find_isabelle", "isabelle_available", "isabelle_decide_modal", "check_theory",
+    "IsabelleInstall", "IsabelleNotAvailable", "BuildResult", "ModalVerdict",
+    "modal_axiom_names",
     "from_z3", "parse_smtlib", "load_smtlib",
     "find_fitch_proof", "fitch_prove", "is_valid_fitch",
     "tableau_closed", "is_valid_tableau", "prove_tableau", "tableau_model",

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/unicode_fol_kit/hol/__init__.py

@@ -3,9 +3,15 @@
 This subpackage *emits* Benzmüller-style shallow embeddings of the toolkit's non-fuzzy
 logics into higher-order logic — as complete, self-contained problem files for an
 external prover (Leo-III / Satallax on TPTP **THF**, or Isabelle/HOL theories for
-Sledgehammer). The toolkit emits; it does **not** run the prover. First-order modal
-logic, FOL and SOL are undecidable / not semi-decidable, so a successful emission means
-"here is a sound problem an external prover *may* discharge", never "decided".
+Sledgehammer). The exporters only emit; a successful emission means "here is a sound
+problem an external prover *may* discharge", never "decided" — first-order modal logic,
+FOL and SOL are undecidable / not semi-decidable.
+
+The optional :mod:`~unicode_fol_kit.hol.isabelle_runner` is the other half: if a local
+Isabelle/HOL is installed, it actually *runs* it on the emitted modal theories
+(prove-battery + nitpick) and reads a VALID / INVALID / UNKNOWN verdict off the build —
+turning "emit" into "proven / refuted". It is sound (Isabelle's kernel certifies the
+proof; nitpick reports only genuine counter-models) and, necessarily, incomplete.
 
 Modules:
 
@@ -24,7 +30,13 @@ Modules:
   via the Gödel–McKinsey–Tarski translation into S4 then the alethic SSE.
 """
 
-from .isabelle_modal import to_isabelle_modal, isabelle_modal_theory, ISABELLE_TACTICS
+from .isabelle_modal import (
+    to_isabelle_modal, isabelle_modal_theory, ISABELLE_TACTICS, modal_axiom_names,
+)
+from .isabelle_runner import (
+    find_isabelle, isabelle_available, isabelle_decide_modal, check_theory,
+    IsabelleInstall, IsabelleNotAvailable, BuildResult, ModalVerdict, DEFAULT_METHODS,
+)
 from .thf_modal import to_thf_modal_full, thf_full_definitions, thf_full_frame_axioms
 from .classical import to_thf_fol, to_isabelle_fol, to_thf_msfol, to_isabelle_msfol
 from .manyvalued import (
@@ -39,6 +51,10 @@ from .intuitionistic import (
 
 __all__ = [
     "to_isabelle_modal", "isabelle_modal_theory", "ISABELLE_TACTICS",
+    "modal_axiom_names",
+    "find_isabelle", "isabelle_available", "isabelle_decide_modal", "check_theory",
+    "IsabelleInstall", "IsabelleNotAvailable", "BuildResult", "ModalVerdict",
+    "DEFAULT_METHODS",
     "to_thf_modal_full", "thf_full_definitions", "thf_full_frame_axioms",
     "to_thf_fol", "to_isabelle_fol", "to_thf_msfol", "to_isabelle_msfol",
     "to_thf_k3lp", "to_isabelle_k3lp",

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/unicode_fol_kit/hol/intuitionistic.py

@@ -153,21 +153,40 @@ _ISA_BOX = "\\<^bold>\\<box>"
 # a distinct, valid lowercase identifier. (The THF path aliases these separately.)
 _ISA_ATOM_ALIASES = {"⊥": "bottom", "⊤": "top", "=": "feq", "≠": "fneq"}
 
+# Identifiers the emitted theory already uses structurally: the world type ``i``, the
+# accessibility relation ``r`` and the free variables ``w``/``v``/``u`` of its frame
+# axioms (``r_refl: "r w w"``, ``r_trans: "r w v ⟹ r v u ⟹ r w u"``), and the lifted
+# operator names. An atom predicate that sanitised to one of these would emit a SECOND
+# ``consts`` with that name (a duplicate-constant clash that Isabelle rejects — so the
+# theory would not load even for a valid formula, e.g. the atom ``r`` in ``r → r``), or
+# make the frame axioms ill-typed (an atom ``w`` shadowing the type-``i`` bound var).
+# A colliding atom is de-collided with the ``p_`` prefix (a trailing ``_`` would be a
+# *bad* Isabelle identifier).
+_ISA_RESERVED = frozenset({
+    "i", "r", "w", "v", "u",
+    "mnot", "mand", "mor", "mimp", "mbox", "mvalid",
+})
+
 
 def _isa_atom_name(name: str) -> str:
     """A safe, *distinct* Isabelle constant name for an atom predicate.
 
     Distinct source atoms must map to distinct legal identifiers. Reserved/symbolic
     atoms (⊥, ⊤, =, ≠) are aliased to dedicated lowercase ids; everything else is
-    sanitised char-by-char (alnum/underscore), and a ``p_`` prefix is prepended when
-    the result is empty, is the bare reserved ``_`` token, or starts with ``_`` (all
-    of which are illegal or reserved as a bare Isabelle constant name).
+    sanitised char-by-char (alnum/underscore), a ``p_`` prefix is prepended when the
+    result is empty, is the bare reserved ``_`` token, or starts with ``_`` (all of
+    which are illegal or reserved as a bare Isabelle constant name), and a name that
+    would collide with a structural identifier of the theory (the relation ``r``, an
+    axiom variable ``w``/``v``/``u``, the world type ``i``, a lifted operator) is
+    de-collided with the ``p_`` prefix (``r`` → ``p_r``).
     """
     if name in _ISA_ATOM_ALIASES:
         return _ISA_ATOM_ALIASES[name]
     safe = "".join(c if (c.isalnum() or c == "_") else "_" for c in name)
     if not safe or safe[0] == "_" or not safe[0].isalpha():
         safe = "p_" + safe
+    if safe in _ISA_RESERVED:
+        safe = "p_" + safe          # p_r / p_w / … (a trailing '_' is a bad Isabelle id)
     return safe
 
 
@@ -209,9 +228,19 @@ def to_isabelle_intuitionistic(formula: Node, theory_name: str = "IPL_GMT") -> s
     theory: worlds as a type ``i``; an accessibility relation ``r`` fixed to be
     reflexive + transitive (the **S4** frame); the lifted modal operators as
     abbreviations; the atoms as ``consts``; and the embedded formula as a genuine
-    ``lemma`` (``\\<lfloor> T(formula) \\<rfloor>``) to be discharged with
-    Sledgehammer / ``auto``. The lemma is provable iff ``formula`` is
-    intuitionistically valid (Gödel–McKinsey–Tarski).
+    ``lemma`` (``\\<lfloor> T(formula) \\<rfloor>``). The lemma is a theorem iff
+    ``formula`` is intuitionistically valid (Gödel–McKinsey–Tarski).
+
+    The proof is emitted **verdict-dependently** from the module's *decidable* S4
+    oracle :func:`gmt_is_s4_valid` (Z3 on the GMT→S4 translation, decisive on this
+    propositional fragment): when the formula is valid the theory carries a real,
+    Isabelle-checked proof (``using r_refl r_trans by (metis … | meson … | blast |
+    auto)`` — the S4 frame facts must be in scope, a bare ``axiomatization`` fact is
+    not in the default claset); when it is not valid the lemma is left ``oops`` (no
+    proof exists; see
+    :func:`~unicode_fol_kit.semantics.intuitionistic.int_countermodel`). The decision
+    deliberately does **not** use ``int_valid``'s default 3-world bound, which is
+    incomplete (IPL's finite-model bound grows with the formula).
 
     Unlike :func:`unicode_fol_kit.fol.qml.to_isabelle_modal` (an alethic skeleton
     that puts the lemma in a comment and defines only ``mnot``/``mbox``/``mvalid``),
@@ -219,6 +248,14 @@ def to_isabelle_intuitionistic(formula: Node, theory_name: str = "IPL_GMT") -> s
     The toolkit only *emits* the theory; it does not run Isabelle.
     """
     s4 = gmt_translate(formula)
+    # Decide validity with the module's own DECIDABLE S4 oracle (Z3 on the GMT→S4
+    # translation), NOT int_valid's bounded Kripke search: int_valid defaults to a
+    # 3-world bound, but IPL's finite-model-property bound grows with the formula, so
+    # int_valid can wrongly call a non-theorem valid — e.g. (p→q)∨(q→r)∨(r→p) is
+    # IPL-INVALID but needs 4 worlds to refute — which would emit a real proof for a
+    # NON-theorem that then fails to build. gmt_is_s4_valid is decisive on this
+    # propositional S4 fragment, so the emitted proof is sound by construction.
+    valid = gmt_is_s4_valid(formula)
     atoms = _isa_atoms(s4)
     R = "\\<Rightarrow>"
     lines = [
@@ -259,8 +296,16 @@ def to_isabelle_intuitionistic(formula: Node, theory_name: str = "IPL_GMT") -> s
         lines.append(f"consts {_isa_atom_name(a)} :: \"\\<sigma>\"")
     lines.append("")
     lines.append("lemma gmt_goal: \"\\<lfloor> " + _isa_render(s4) + " \\<rfloor>\"")
-    lines.append("  \\<comment> \\<open>discharge with: by (metis r_refl r_trans) or sledgehammer\\<close>")
-    lines.append("  oops  \\<comment> \\<open>replace 'oops' with a proof once a prover closes it\\<close>")
+    if valid:
+        # A real, Isabelle-checked proof. The S4 frame facts must be brought into
+        # scope (a bare `axiomatization` fact is not in the default claset), then a
+        # small method battery closes the GMT goal.
+        lines.append("  using r_refl r_trans")
+        lines.append("  by (metis r_refl r_trans | meson r_refl r_trans | blast | auto)")
+    else:
+        lines.append("  \\<comment> \\<open>NOT intuitionistically valid: no proof exists "
+                     "(see int_countermodel for a Kripke counter-model)\\<close>")
+        lines.append("  oops")
     lines.append("")
     lines.append("end")
     return "\n".join(lines) + "\n"

{unicode_fol_kit-0.7.0 → unicode_fol_kit-0.8.0}/unicode_fol_kit/hol/isabelle_modal.py

@@ -64,7 +64,8 @@ Public API
 and the constant :data:`ISABELLE_TACTICS`.
 """
 
-from typing import List
+import re
+from typing import List, Optional
 
 from unicode_fol_kit.fol.nodes import (
     Node, Variable, Constant, Number, Function,
@@ -112,6 +113,27 @@ ISABELLE_TACTICS = {
     "sorry": "  sorry",
 }
 
+# Tactics whose ``by ...`` proof needs the frame / domain axioms brought into the
+# proof context: a bare ``axiomatization where r_refl: ...`` fact is NOT in the
+# default claset/simpset, so ``by blast`` / ``by auto`` / ``by (metis ...)`` cannot
+# see it and any axiom-dependent validity (T/S4/S5/KD/KD45, temporal closure, a
+# domain regime) fails to discharge even though the formula is valid and the theory
+# sound. For these tactics we emit ``using <axioms> by <tactic>``. ``sledgehammer``
+# finds its own facts; ``oops`` / ``sorry`` prove nothing, so they are excluded.
+_BY_TACTICS = frozenset({"auto", "blast", "metis", "smt", "simp", "force"})
+
+_AXIOM_NAME_RE = re.compile(r"axiomatization where (\w+):")
+
+
+def _axiom_names(axiom_lines: List[str]) -> List[str]:
+    """Read the fact names out of emitted ``axiomatization where NAME: ...`` lines."""
+    out: List[str] = []
+    for ln in axiom_lines:
+        m = _AXIOM_NAME_RE.search(ln)
+        if m:
+            out.append(m.group(1))
+    return out
+
 # Equality / inequality are uninterpreted, world-relativized predicates here (NOT
 # primitive HOL `=`), matching satisfies_modal and the THF export. These aliases
 # give them valid, distinct Isabelle constant names.
@@ -490,6 +512,20 @@ def _next_in_temporal_axiom() -> List[str]:
     return ['axiomatization where n_in_t: "n w v \\<Longrightarrow> t w v"']
 
 
+def _temporal_next_closure_axiom() -> List[str]:
+    r"""Pin the henceforth relation ``t`` to the reflexive-transitive CLOSURE of ``n``.
+
+    ``n_in_t`` gives ``n ⊆ t`` and the temporal axioms make ``t`` reflexive+transitive,
+    so ``n** ⊆ t``. This adds the converse ``t ⊆ n**`` (``rtranclp n``), so ``t = n**``
+    EXACTLY — matching :func:`satisfies_modal`, which reads ``Always`` / ``Eventually``
+    over the reflexive-transitive *closure* of the one-step ``"temporal"`` relation.
+    Without it ``t`` may be any refl-trans superset of ``n``, and a formula valid only
+    because ``t = closure(n)`` (e.g. the temporal induction ``(p ∧ G(p→Xp)) → Gp``) is
+    spuriously refutable in the embedding — a **false INVALID** under the runner.
+    """
+    return ['axiomatization where t_in_nstar: "t w v \\<Longrightarrow> rtranclp n w v"']
+
+
 def _deontic_axioms() -> List[str]:
     """Standard Deontic Logic KD: the deontic relation is serial."""
     return ['axiomatization where d_serial: "\\<exists>v. d w v"']
@@ -511,6 +547,48 @@ def _domain_axioms(mode: str) -> List[str]:
     return out
 
 
+def _collect_axioms(sig: "_Sig", frame: str, mode: str,
+                    temporal_closure: bool) -> List[str]:
+    """All ``axiomatization where ...`` lines the theory emits, in emission order.
+
+    Centralised so the proof emitter and :func:`modal_axiom_names` agree on exactly
+    which axioms are in scope (the proof must ``using`` precisely these to discharge
+    an axiom-dependent validity).
+    """
+    axioms: List[str] = []
+    if sig.uses_alethic:
+        axioms += _frame_axioms(frame)
+    if sig.uses_deontic:
+        axioms += _deontic_axioms()
+    if sig.uses_temporal and temporal_closure:
+        axioms += _temporal_axioms()
+    # When Next (n) co-occurs with Always/Eventually (t), link n into t so the
+    # oracle-valid Always(P) -> Next(P) is a theorem of the emitted theory too...
+    if sig.uses_temporal and sig.uses_next:
+        axioms += _next_in_temporal_axiom()
+        # ...and, when t is the closure relation, pin t = n** exactly (not merely a
+        # refl-trans superset of n), so satisfies_modal-valid temporal-induction
+        # formulas are not spuriously refuted (false INVALID).
+        if temporal_closure:
+            axioms += _temporal_next_closure_axiom()
+    if sig.has_quant:
+        axioms += _domain_axioms(mode)
+    return axioms
+
+
+def _proof_lines(tactic: str, axiom_ids: List[str]) -> List[str]:
+    """The proof block for ``tactic``, bringing the frame/domain axioms into scope.
+
+    For a ``by``-style tactic (:data:`_BY_TACTICS`) we prepend ``using <axioms>`` so
+    ``blast`` / ``auto`` / ``metis`` can actually use them; ``sledgehammer`` / ``oops``
+    / ``sorry`` are emitted verbatim.
+    """
+    body = ISABELLE_TACTICS[tactic]
+    if tactic in _BY_TACTICS and axiom_ids:
+        return ["  using " + " ".join(axiom_ids), body]
+    return [body]
+
+
 # --------------------------------------------------------------------------- #
 # Type declarations for the discovered signature.
 # --------------------------------------------------------------------------- #
@@ -558,6 +636,7 @@ def isabelle_modal_theory(
     tactic: str = "sledgehammer",
     theory_name: str = "ModalEmbedding",
     temporal_closure: bool = True,
+    proof: Optional[str] = None,
 ) -> str:
     """Emit a complete, loadable Isabelle/HOL theory shallow-embedding ``formula``.
 
@@ -588,8 +667,15 @@ def isabelle_modal_theory(
         tactic: a key of :data:`ISABELLE_TACTICS`. The default ``"sledgehammer"``
             emits a Sledgehammer hook plus ``oops`` so the theory loads without
             claiming a proof; ``"metis"`` / ``"auto"`` / ``"blast"`` / ``"smt"`` emit a
-            ``by ...`` proof; ``"sorry"`` admits the goal.
+            ``by ...`` proof. For these ``by``-style tactics the proof is prefixed
+            with ``using <frame/domain axioms>`` so an axiom-dependent validity
+            (T/S4/S5/KD/KD45, temporal closure, domain regime) can actually
+            discharge — a bare ``axiomatization`` fact is not in the default claset.
+            ``"sorry"`` admits the goal.
         theory_name: the Isabelle theory name (must match the .thy filename).
+        proof: an explicit proof block to emit verbatim in place of the ``tactic``
+            preset (used by the Isabelle runner to splice in a prove-battery or a
+            ``nitpick`` invocation). When ``None`` the ``tactic`` preset is used.
         temporal_closure: when True, constrain ``t`` to be reflexive+transitive so
             ``Always`` / ``Eventually`` denote the henceforth (refl-trans-closure)
             reading of :func:`satisfies_modal`. ``Next`` always uses the one-step
@@ -661,37 +747,50 @@ def isabelle_modal_theory(
         lines.append("")
 
     # Axioms.
-    axioms: List[str] = []
-    if sig.uses_alethic:
-        axioms += _frame_axioms(frame)
-    if sig.uses_deontic:
-        axioms += _deontic_axioms()
-    if sig.uses_temporal and temporal_closure:
-        axioms += _temporal_axioms()
-    # When Next (n) co-occurs with Always/Eventually (t), link n into t so the
-    # oracle-valid Always(P) -> Next(P) is a theorem of the emitted theory too.
-    if sig.uses_temporal and sig.uses_next:
-        axioms += _next_in_temporal_axiom()
-    if sig.has_quant:
-        axioms += _domain_axioms(mode)
+    axioms = _collect_axioms(sig, frame, mode, temporal_closure)
     if axioms:
         lines += axioms
         lines.append("")
 
-    # The real lemma.
+    # The real lemma. Its proof brings the frame/domain axioms into scope (see
+    # _proof_lines) so an axiom-dependent validity actually discharges; an explicit
+    # ``proof`` override (used by the runner's prove-battery / nitpick) wins.
     lines.append(f'lemma modal_goal: "\\<lfloor> {body} \\<rfloor>"')
-    lines.append(ISABELLE_TACTICS[tactic])
+    if proof is not None:
+        lines.append(proof.rstrip("\n"))
+    else:
+        lines += _proof_lines(tactic, _axiom_names(axioms))
     lines.append("")
     lines.append("end")
     return "\n".join(lines) + "\n"
 
 
+def modal_axiom_names(
+    formula: Node,
+    mode: str = "constant",
+    frame: str = "K",
+    temporal_closure: bool = True,
+) -> List[str]:
+    """The names of the ``axiomatization`` facts the emitted theory would declare.
+
+    These are exactly the frame / domain / temporal-link axioms in scope for the
+    proof of ``modal_goal``. The Isabelle runner needs them to build a ``using
+    <axioms> by <method>`` proof (or to know none are required), so this exposes the
+    same computation :func:`isabelle_modal_theory` uses internally.
+    """
+    _validate(mode, frame, "oops")
+    sig = _Sig()
+    _scan(formula, sig)
+    return _axiom_names(_collect_axioms(sig, frame, mode, temporal_closure))
+
+
 def to_isabelle_modal(
     formula: Node,
     mode: str = "constant",
     frame: str = "K",
     tactic: str = "sledgehammer",
     temporal_closure: bool = True,
+    proof: Optional[str] = None,
 ) -> str:
     """Emit a complete, loadable Isabelle/HOL theory embedding ``formula`` (real lemma).
 
@@ -709,4 +808,4 @@ def to_isabelle_modal(
     """
     return isabelle_modal_theory(
         formula, mode=mode, frame=frame, tactic=tactic,
-        theory_name="ModalEmbedding", temporal_closure=temporal_closure)
+        theory_name="ModalEmbedding", temporal_closure=temporal_closure, proof=proof)