unicode-logic-kit 0.31.0__py3-none-any.whl

unicode_logic_kit/semantics/intuitionistic.py

@@ -0,0 +1,581 @@
+"""Intuitionistic propositional logic — Kripke semantics and a validity/countermodel search.
+
+Intuitionistic logic drops the law of excluded middle and double-negation elimination;
+its models are **Kripke models**: a partial order of *worlds* (stages of knowledge)
+with a **monotone** forcing relation (once an atom is forced at a world it is forced at
+every later world). The connectives ``→`` and ``¬`` quantify over future worlds, which
+is exactly what makes ``P ∨ ¬P`` and ``¬¬P → P`` fail.
+
+- :class:`IntKripkeModel` — build a model and ask ``model.forces(world, φ)``.
+- :func:`int_valid` — is ``φ`` intuitionistically valid? A propositional formula is
+  decided exactly: the search over small Kripke models is tried first, and what it
+  does not settle is handed to the G4ip calculus of :func:`~unicode_logic_kit.atp.lj.int_prove`.
+- :func:`int_countermodel` — a model + world where ``φ`` fails (a witness that it is
+  *not* intuitionistically valid), or None. ``None`` says that no such model was found
+  among the models of at most ``max_worlds`` worlds; it is NOT a proof of validity.
+  Intuitionistic propositional logic has the finite-model property, but the size of the
+  smallest countermodel grows with the formula: ``(P → Q) ∨ (Q → R) ∨ (R → P)`` is not
+  valid and has no countermodel with fewer than four worlds, so at the default bound of
+  three worlds the search comes up empty on it. Only :func:`int_valid` (which goes on to
+  the calculus) and :func:`~unicode_logic_kit.atp.lj.int_decide` answer for validity.
+
+The **propositional** fragment is decided exactly by :func:`int_valid`. The
+**first-order** fragment (``∀x`` / ``∃x``) is handled over *increasing-domain* Kripke
+models — ``w ⊩ ∀x φ`` quantifies over every later world and every individual existing
+there — by a *bounded* search: a counter-model it finds genuinely refutes validity,
+but a clean search does **not** prove validity (first-order intuitionistic logic is
+undecidable, and some non-theorems such as the double-negation shift have only infinite
+counter-models, being valid in every finite model). Every intuitionistic validity is
+also classically valid, which the test-suite cross-checks.
+
+**A free variable is a parameter.** ``Γ ⊨ φ`` is the consequence relation of the
+textbooks, over every model, every world and every assignment: a variable that is free
+in a formula names ONE unknown individual, the same in every part of the formula, and an
+assignment gives it an individual that exists at the world of evaluation. In an
+increasing-domain model that individual then exists at every later world too, so the
+search reads the parameter as a CONSTANT named like the variable: rigid, and a member of
+every world's domain. Nothing is lost by it: a formula is checked at every world of
+every model, and the submodel generated by a world has the individual in all of its
+domains. ``P(x) → P(a)`` is not valid (one world, domain ``{x, a}``, ``P`` of ``x``
+only), ``P(x) → P(x)``, ``P(x) → ∃y P(y)`` and ``∀y P(y) → P(x)`` are, ``(P(x) ∧ Q(y)) →
+∀z (P(z) ∧ Q(z))`` is not (``P`` of ``x``, ``Q`` of ``y``, two elements); for a formula
+without a premise the reading coincides with the universal closure. The model that
+:func:`int_countermodel` returns has the individual under the variable's own name; a
+variable and a constant spelled alike would be one individual there, so the pair is
+refused by name. A formula with no quantifier is propositional whatever its terms are:
+an atom is a letter, a variable in it stands for itself, and two atoms whose terms differ
+are two letters, which is what a parameter allows (no quantifier-free formula can tie
+two terms together, and the identity atom is refused).
+
+A **numeral** in an atom of the first-order search is the constant of its value
+(``1`` and ``1.0`` are one; a constant spelled like a numeral of the same formula is
+refused by name), and a predicate used at two arities is two predicates.
+
+**Many-sorted formulas** (``SortedQuantifier``, ``∀x:S φ`` / ``∃x:S φ``) are decided by
+delegating ONCE, at the top of :func:`int_valid` / :func:`int_countermodel`, to the same
+``_relativize`` reduction :mod:`unicode_logic_kit.fol.to_fol` uses (``∀x:S φ`` → ``∀x (S(x)
+→ φ)``, ``∃x:S φ`` → ``∃x (S(x) ∧ φ)``) — done ONCE for the WHOLE formula, rather than
+node-by-node inside the search, so a ``SortedConstant`` anywhere in the formula (not only
+one directly under a ``SortedQuantifier``) is also turned into a plain ``Constant`` before
+:func:`_fo_countermodel` scans for constants/predicates. The sort guard ``S(x)`` becomes an
+ordinary atom, forced exactly like any other predicate — and every atom's valuation in this
+module is already required to be MONOTONE (up-closed along the order, see
+:func:`_upclosed_subsets` / :func:`_monotone_valuations`), so a sort is "stage-stable" (once
+forced, stays forced at every later stage) but not fully rigid (an individual need not
+already be of sort ``S`` at the initial stage) — the natural reading given the module's
+existing atom semantics, and the same "world/stage-relative, not rigid" choice
+:func:`~unicode_logic_kit.semantics.kripke.satisfies_modal` makes for the modal routes.
+
+Non-emptiness and membership: the classical many-sorted routes (``api.prove`` et al.)
+always assume every sort is non-empty and every sorted constant ``c:S`` is an element of
+``S``, by adding :func:`~unicode_logic_kit.fol._msfl_nodes.sort_axioms` as extra premises —
+without the matching assumption here, a schema like ``∀x:S P(x) → ∃x:S P(x)`` would come
+out intuitionistically INVALID (a countermodel with ``S`` empty everywhere) while being
+classically valid, and ``∀x:Human Mortal(x) → Mortal(socrates:Human)`` would have the
+countermodel in which ``socrates`` is no ``Human`` — the "bare relativisation is
+inconsistent with the classical routes" trap the sort-guard-relativisation approach
+warns about. So :func:`int_valid` / :func:`int_countermodel` fold those same sentences
+in as EXTRA PREMISES — checking ``⋀sort_axioms → relativised-formula`` — the
+standard "no separate premise list" trick, sound both classically and intuitionistically
+for a FINITE premise set (the deduction theorem holds in both). A many-sorted formula's
+:func:`int_valid` / :func:`int_countermodel` verdict therefore agrees with
+``api.prove``/Z3's on any MODAL-FREE sorted formula the propositional-or-bounded-first-order
+fragments both decide — see ``tests/test_sorted_modal.py``.
+
+Public API: :class:`IntKripkeModel`, :func:`int_valid`, :func:`int_countermodel`.
+"""
+
+from dataclasses import dataclass
+from itertools import combinations, product
+from typing import Dict, FrozenSet, List, Optional, Tuple
+
+from ..fol.nodes import (
+    Node, Atom, Not, And, Or, Xor, Implies, Iff, Quantifier, SortedQuantifier,
+    Constant, Variable, Function, substitute,
+)
+from ..fol._so_nodes import SecondOrderQuantifier
+from ..fol._atom_keys import find_key
+from ..fol._msfl_nodes import key_text, sort_axioms
+from ..fol._free_parameters import parameterize
+from ..fol._numeral_symbols import numerals_as_constants, numeral_name
+from ..fol._truth_constants import truth_value as _truth_value
+from ._modal_reject import reject_equality_in
+
+
+def _is_propositional(formula: Node) -> bool:
+    """True iff ``formula`` has no quantifier (the decidable propositional fragment).
+
+    Checks for ``SortedQuantifier`` too, even though ``int_valid``/
+    ``int_countermodel`` always relativize a many-sorted formula away (see
+    :func:`_prepare_many_sorted`) before this is ever called on it from those
+    two entry points -- so in practice this branch never fires there. It is
+    kept anyway: a caller may run this directly on a formula that still has
+    its ``SortedQuantifier`` nodes, and it must answer correctly there too.
+    """
+    return not any(
+        isinstance(node, (Quantifier, SortedQuantifier, SecondOrderQuantifier))
+        for node in formula.walk())
+
+
+def _prepare_many_sorted(formula: Node) -> Node:
+    """Relativize a many-sorted formula ONCE, for the search entry points.
+
+    ``int_valid``/``int_countermodel`` call this before anything else. Two
+    things happen together, both needed for the search to agree with the
+    classical many-sorted routes on a many-sorted formula (see the module
+    docstring's "Many-sorted formulas" section):
+
+    1. The WHOLE formula is relativized in one pass (``formula._relativize([])``
+       — the same reduction :func:`~unicode_logic_kit.fol.to_fol` uses), not
+       node-by-node during the search. Doing it once, up front, also turns a
+       ``SortedConstant`` occurring ANYWHERE in the formula (not only directly
+       under a ``SortedQuantifier``) into a plain ``Constant`` before
+       :func:`_fo_countermodel` scans the formula for its constants — a
+       per-node fix inside the search would miss that case.
+    2. The two facts every classical route assumes of a sort
+       (:func:`~unicode_logic_kit.fol._msfl_nodes.sort_axioms`: no sort is empty,
+       and a sorted constant ``c:S`` is an element of ``S``) are folded in
+       here as an extra premise too — checking
+       ``⋀sort-axioms → relativized-formula`` in place of the bare relativized
+       formula. Sound both classically and intuitionistically for a finite
+       premise set (the deduction theorem holds in both), and it is what makes
+       e.g. ``∀x:S P(x) → ∃x:S P(x)`` agree with the classical Z3 verdict here
+       instead of finding an empty-``S`` countermodel, and
+       ``∀x:Human Mortal(x) → Mortal(socrates:Human)`` valid (``socrates`` is a
+       ``Human``) while the same formula with a plain ``socrates`` is not.
+
+       The membership fact is an ANTECEDENT, not a conjunct of the formula. A
+       valuation is up-closed, so ``S(c)`` forced at a stage is forced at every
+       later one, and the clause for ``→`` only looks upward: the wrapped
+       formula is forced everywhere in every model iff the relativized formula
+       is forced in every model in which ``S(c)`` is forced at every stage
+       (restrict a refuting model to the up-set of the stage where the
+       antecedent holds). That is exactly "the constant is in its sort", with
+       the sort a stage-relative atom like every other one here.
+
+    Returns ``formula`` UNCHANGED (same object, not even copied) when it has
+    no many-sorted node at all — ``sort_axioms`` returning nothing IS
+    exactly "no ``SortedQuantifier``/``SortedConstant``/``SortedCount``/
+    ``SortedCardinality`` anywhere in it" (the same four types
+    ``_relativize`` would otherwise eliminate), so every call site that never
+    used many_sorted sees byte-identical behaviour to before this existed.
+    """
+    axioms = sort_axioms(formula)
+    if not axioms:
+        return formula
+    relativized = formula._relativize([])
+    hyp = axioms[0]
+    for ax in axioms[1:]:
+        hyp = And(hyp, ax)
+    return Implies(hyp, relativized)
+
+
+#: Identity is not one of the atoms this search can read. A world's valuation is
+#: a set of atom KEYS (the text of the atom with every constant written by its name),
+#: monotone along the order, so
+#: ``a = b`` would be an unconstrained letter: ``int_valid(a = a)`` came back False
+#: and ``int_countermodel(a = a)`` handed back a one-world model as if it refuted
+#: reflexivity (both measured on 0.28.1). The Gödel–McKinsey–Tarski embedding
+#: (:mod:`unicode_logic_kit.hol.intuitionistic`) already refuses the atom by name, and
+#: THIS module is the oracle it is checked against, so the two have to agree about
+#: what they will not answer. Intuitionistic logic WITH equality needs a term
+#: semantics neither this search nor G4ip has, and it is not part of the GMT theorem.
+_EQUALITY_ROUTE = "the intuitionistic Kripke search"
+_EQUALITY_ATOM_READING = ("a world's valuation is a monotone set of atom keys, "
+                          "and no term is interpreted")
+_EQUALITY_INSTEAD = (
+    "Decide identity classically with unicode_logic_kit.api.prove, or on the "
+    "quantified modal route with unicode_logic_kit.fol.qml.qml_is_valid (rigid "
+    "identity over the object domain); intuitionistic logic with equality is not "
+    "what this search or atp.lj.int_prove decides."
+)
+
+
+def _reject_equality_everywhere(formula: Node, caller: str) -> None:
+    """Refuse an identity atom anywhere in ``formula``, before any search.
+
+    A whole-tree scan at the entry point, not a check inside the evaluator: the
+    search stops at the first refuting model, so a formula whose countermodel is
+    found before the identity atom is reached would come back with a verdict that
+    never read it — ``(p ∧ ¬p) → (a = b)`` is the clean case, intuitionistically
+    valid without the atom mattering at all.
+    """
+    reject_equality_in(formula, caller, _EQUALITY_ROUTE,
+                       atom_reading=_EQUALITY_ATOM_READING,
+                       instead=_EQUALITY_INSTEAD)
+
+
+def _reject_second_order(formula: Node) -> None:
+    """Reject a second-order quantifier or a function term in the FO search.
+
+    A sorted quantifier/constant needs no rejection here any more: by the
+    time :func:`_fo_countermodel` calls this, ``int_valid``/
+    ``int_countermodel`` have already relativized it away (see
+    :func:`_prepare_many_sorted`), so it is an ordinary (unsorted)
+    first-order formula.
+    """
+    for node in formula.walk():
+        if isinstance(node, SecondOrderQuantifier):
+            raise ValueError("intuitionistic: second-order quantifiers are not supported.")
+        if isinstance(node, Function):
+            raise ValueError(
+                "intuitionistic: function terms are not supported in the first-order "
+                "Kripke search; use predicates over variables and constants.")
+
+
+@dataclass(frozen=True)
+class IntKripkeModel:
+    """A finite intuitionistic Kripke model over the worlds ``0`` to ``n-1``.
+
+    ``upset[w]`` is the set of worlds accessible from ``w`` (its up-set in the partial
+    order, reflexive and transitive — including ``w`` itself). ``valuation[key]`` is the
+    up-closed set of worlds forcing the atom ``key`` (its text with every constant written by
+    its name, ``P(a)`` for the atom ``P`` of the constant ``a``; the text of the atom as a
+    formula, ``P('a')``, is read as the same key, and a table that holds both spellings with
+    different sets of worlds is refused). Build directly, or let :func:`int_countermodel`
+    produce one, keyed by the names.
+    """
+
+    upset: Dict[int, FrozenSet[int]]
+    valuation: Dict[str, FrozenSet[int]]
+    domains: Optional[Dict[int, FrozenSet]] = None
+
+    def forces(self, world: int, formula: Node) -> bool:
+        """Return whether ``world`` forces ``formula`` (the intuitionistic clauses).
+
+        First-order clauses (when the model carries per-world ``domains``, which must
+        be **increasing** along the order): ``w ⊩ ∀x φ`` iff for every later ``w' ≥ w``
+        and every ``d ∈ D_{w'}``, ``w' ⊩ φ[x:=d]``; ``w ⊩ ∃x φ`` iff some ``d ∈ D_w``
+        has ``w ⊩ φ[x:=d]``.
+        """
+        if isinstance(formula, Quantifier):
+            if self.domains is None:
+                raise ValueError(
+                    "intuitionistic forcing: a quantifier needs per-world domains "
+                    "(build the model with domains={world: [...]}).")
+            var = formula.variable
+            if formula.type in ("∀", "forall"):
+                return all(
+                    self.forces(w2, substitute(formula.formula, var, Constant(d)))
+                    for w2 in self.upset[world] for d in self.domains[w2])
+            if formula.type in ("∃", "exists"):
+                return any(
+                    self.forces(world, substitute(formula.formula, var, Constant(d)))
+                    for d in self.domains[world])
+            raise ValueError(f"intuitionistic forcing: unknown quantifier {formula.type!r}")
+        if isinstance(formula, Atom):
+            constant = _truth_value(formula)
+            if constant is not None:
+                return constant     # `$true` is forced at every world, `$false` at none
+            # The key first, then the formula text: the elements of the domain are substituted
+            # as constants (``Constant("a")`` is ``'a'`` in the text of a formula), the
+            # valuation of a model is keyed ``P(a)``, and a caller who keyed it by the text of
+            # a hand-built atom, ``P('a')``, is read the same.
+            found = find_key(self.valuation, formula)
+            return found is not None and world in self.valuation[found]
+        if isinstance(formula, And):
+            return self.forces(world, formula.left) and self.forces(world, formula.right)
+        if isinstance(formula, Or):
+            return self.forces(world, formula.left) or self.forces(world, formula.right)
+        if isinstance(formula, Implies):
+            # w ⊩ A→B  iff  for every w' ≥ w, w' ⊩ A implies w' ⊩ B.
+            return all(self.forces(w2, formula.right)
+                       for w2 in self.upset[world] if self.forces(w2, formula.left))
+        if isinstance(formula, Not):
+            # w ⊩ ¬A  iff  no w' ≥ w forces A.
+            return not any(self.forces(w2, formula.formula) for w2 in self.upset[world])
+        if isinstance(formula, Iff):
+            return (self.forces(world, Implies(formula.left, formula.right))
+                    and self.forces(world, Implies(formula.right, formula.left)))
+        if isinstance(formula, Xor):
+            # Defined intuitionistically as (A ∨ B) ∧ ¬(A ∧ B).
+            a, b = formula.left, formula.right
+            return self.forces(world, And(Or(a, b), Not(And(a, b))))
+        raise ValueError(f"intuitionistic forcing: unsupported node "
+                         f"{type(formula).__name__}")
+
+
+def _atom_keys(formula: Node) -> List[str]:
+    """Distinct atom keys (propositional variables) in ``formula``.
+
+    A letter is named by the text its atom prints as, so two different atoms that print
+    alike (the numeral ``1`` and a constant named ``1``, a free variable ``x`` and a constant
+    named ``x``) would be one letter and the formula another problem: such a pair is refused
+    by name (``NotImplementedError``). ``$true`` / ``$false`` are constants, not letters.
+    """
+    from ..fol._atom_keys import AtomKeys
+    return AtomKeys("int_countermodel").letters([formula])
+
+
+def _partial_orders(n: int):
+    """Yield each partial order on ``{0..n-1}`` as a dict ``world -> up-set frozenset``.
+
+    Enumerates reflexive relations and keeps the transitive (and antisymmetric) ones;
+    the up-set ``upset[w] = {w' : w ≤ w'}`` is what the forcing clauses consult.
+    """
+    worlds = list(range(n))
+    off_diagonal = [(i, j) for i in worlds for j in worlds if i != j]
+    for mask in product((False, True), repeat=len(off_diagonal)):
+        leq = {(i, i) for i in worlds}
+        leq |= {pair for pair, inc in zip(off_diagonal, mask) if inc}
+        # transitivity
+        if any((a, b) in leq and (b, c) in leq and (a, c) not in leq
+               for a in worlds for b in worlds for c in worlds):
+            continue
+        # antisymmetry (a genuine partial order; preorders collapse to these for forcing)
+        if any(a != b and (a, b) in leq and (b, a) in leq for a in worlds for b in worlds):
+            continue
+        yield {w: frozenset(j for j in worlds if (w, j) in leq) for w in worlds}
+
+
+def _monotone_valuations(upset: Dict[int, FrozenSet[int]], keys: List[str]):
+    """Yield every monotone (up-closed) valuation of ``keys`` over the order ``upset``."""
+    worlds = list(upset)
+    # Up-closed subsets: a set S with w∈S ⇒ upset[w] ⊆ S.
+    upclosed = []
+    for r in range(len(worlds) + 1):
+        for combo in combinations(worlds, r):
+            s = frozenset(combo)
+            if all(upset[w] <= s for w in s):
+                upclosed.append(s)
+    for choice in product(upclosed, repeat=len(keys)):
+        yield dict(zip(keys, choice))
+
+
+def _upclosed_subsets(upset: Dict[int, FrozenSet[int]], allowed) -> List[FrozenSet[int]]:
+    """Every up-closed subset of the (itself up-closed) world set ``allowed``."""
+    worlds = sorted(allowed)
+    out: List[FrozenSet[int]] = []
+    for r in range(len(worlds) + 1):
+        for combo in combinations(worlds, r):
+            s = frozenset(combo)
+            if all(upset[w] <= s for w in s):
+                out.append(s)
+    return out
+
+
+def _increasing_domains(upset: Dict[int, FrozenSet[int]], consts: List[str], n_fresh: int):
+    """Yield each increasing per-world domain over ``consts`` + up to ``n_fresh`` elements.
+
+    Constants exist at every world (rigid). A base fresh element exists everywhere
+    so no world is empty; each further fresh element appears on an up-closed set of
+    worlds (so the domains grow along the order). The fresh elements are named
+    ``_e0``, ``_e1``, … and skip every name of ``consts``, so a constant or a parameter
+    spelled like one of them is never merged with it.
+    """
+    worlds = sorted(upset)
+    base = set(consts)
+    fresh: List[str] = []
+    index = 0
+    while len(fresh) < n_fresh:
+        candidate = f"_e{index}"
+        index += 1
+        if candidate not in base:
+            fresh.append(candidate)
+    if not fresh:
+        if base:
+            yield {w: frozenset(base) for w in worlds}
+        return
+    always = frozenset(worlds)
+    var_fresh = fresh[1:]
+    options = _upclosed_subsets(upset, worlds)
+    for appearances in product(options, repeat=len(var_fresh)):
+        appear = {fresh[0]: always}
+        appear.update(zip(var_fresh, appearances))
+        domains = {}
+        for w in worlds:
+            elems = set(base) | {fresh[0]}
+            elems.update(e for e in var_fresh if w in appear[e])
+            domains[w] = frozenset(elems)
+        yield domains
+
+
+def _read_first_order_terms(formula: Node) -> Node:
+    """``formula`` with every term of an atom a constant, a function term or a bound variable.
+
+    The search gives a valuation to the ground atoms over the individuals of the model
+    and to nothing else, so a term of any other kind would leave its atom forced at no
+    world at all: ``P(y)`` with ``y`` free would be false in every model, as the
+    antecedent of ``P(y) → ∃x Q(x)`` and as the conclusion of ``∀x P(x) → P(y)``. Three
+    readings put every such term in the search's reach:
+
+    * a numeral is the constant of its value (``1`` and ``1.0`` are one constant), and a
+      constant spelled like a numeral of the formula is refused by name;
+    * a variable that is free is a parameter, read as a constant named like the variable
+      (see the module docstring), and a free variable spelled like a constant of the
+      formula is refused by name;
+    * any other kind of term is refused by name.
+
+    Raises:
+        NotImplementedError: a numeral and a constant are spelled alike, or a free
+            variable and a constant are.
+        ValueError: an atom holds a term of a kind the search does not read.
+    """
+    [formula], _ = numerals_as_constants([formula], where="int_countermodel",
+                                         spell=numeral_name)
+    [formula], _ = parameterize([formula], after_variables=True)
+    for node in formula.walk():
+        if isinstance(node, Atom):
+            for term in node.args:
+                if not isinstance(term, (Variable, Constant, Function)):
+                    raise ValueError(
+                        f"intuitionistic: the term {term.to_unicode_str()!r} of "
+                        f"{node.to_unicode_str()!r} is not a variable, a constant or a "
+                        "numeral, and the first-order Kripke search gives no atom over "
+                        "such a term a valuation; use a constant or a variable.")
+    return formula
+
+
+def _fo_countermodel(formula: Node, max_worlds: int, domain_elements: int,
+                     max_steps: int) -> Optional[Tuple[IntKripkeModel, int]]:
+    """Bounded first-order intuitionistic counter-model search (sound; not a decision).
+
+    Enumerates Kripke models up to ``max_worlds`` worlds with increasing domains drawn
+    from the formula's constants plus ``domain_elements`` fresh individuals, and
+    monotone predicate valuations respecting element existence. A returned model
+    genuinely refutes intuitionistic validity; ``None`` means "no counter-model within
+    the bounds" — NOT a proof of validity (first-order intuitionistic logic is
+    undecidable). The formula's terms are constants and bound variables only (see
+    :func:`_read_first_order_terms`).
+    """
+    _reject_second_order(formula)
+    consts = sorted({n.name for n in formula.walk() if isinstance(n, Constant)})
+    preds: Dict[Tuple[str, int], None] = {}     # one predicate per (name, arity)
+    for node in formula.walk():
+        if isinstance(node, Atom) and _truth_value(node) is None:
+            preds[(node.predicate, len(node.args))] = None
+    steps = 0
+    for n in range(1, max_worlds + 1):
+        for upset in _partial_orders(n):
+            for domains in _increasing_domains(upset, consts, domain_elements):
+                pool = sorted(set().union(*domains.values()))
+                ground, seen = [], set()
+                for name, ar in preds:
+                    for tup in product(pool, repeat=ar):
+                        key = key_text(Atom(name, [Constant(t) for t in tup]))
+                        if key not in seen:
+                            seen.add(key)
+                            allowed = frozenset(w for w in upset if set(tup) <= domains[w])
+                            ground.append((key, _upclosed_subsets(upset, allowed)))
+                keys = [k for k, _ in ground]
+                option_lists = [opts for _, opts in ground]
+                for choice in (product(*option_lists) if ground else [()]):
+                    steps += 1
+                    if steps > max_steps:
+                        return None
+                    model = IntKripkeModel(upset, dict(zip(keys, choice)), domains)
+                    for w in range(n):
+                        if not model.forces(w, formula):
+                            return model, w
+    return None
+
+
+def int_countermodel(formula: Node, max_worlds: int = 3,
+                     domain_elements: int = 2,
+                     max_steps: int = 300000) -> Optional[Tuple[IntKripkeModel, int]]:
+    """Return ``(model, world)`` where ``formula`` fails intuitionistically, or None.
+
+    A returned model genuinely refutes validity: it is a witness that ``formula`` is
+    NOT intuitionistically valid. ``None`` never proves validity, for either fragment.
+    It says that the bounded search found no countermodel, and the bound is a real one.
+    For a **propositional** formula the search runs over every Kripke model of at most
+    ``max_worlds`` worlds (intuitionistic propositional logic has the finite-model
+    property, but the smallest countermodel of a formula can have more worlds than the
+    default allows: ``(P → Q) ∨ (Q → R) ∨ (R → P)`` is not valid, yet ``None`` comes
+    back at ``max_worlds=3`` and a model at ``max_worlds=4``). Ask
+    :func:`int_valid`, or :func:`~unicode_logic_kit.atp.lj.int_decide`, for a verdict on
+    validity: both are exact on a propositional formula. For a **first-order** formula
+    (containing ∀/∃) it is a *bounded* search over increasing-domain Kripke models (the
+    formula's constants plus ``domain_elements`` fresh individuals, up to ``max_steps``
+    valuations), and first-order intuitionistic logic is undecidable, so ``None`` only
+    means "no counter-model within the bounds".
+
+    A variable that is free in ``formula`` is a PARAMETER: one unknown individual,
+    the same everywhere in the formula, which exists in every world of the model (the
+    module docstring has the derivation). The search reads it as a constant named like
+    the variable, so ``∀x P(x) → P(y)`` has no countermodel, ``P(y) → ∃x Q(x)`` has one
+    (the individual ``y`` with ``P`` of it and ``Q`` of nothing) and ``y`` is a member of
+    every domain of the model it returns; evaluate it with
+    ``model.forces(world, substitute(formula, Variable('y'), Constant('y')))``. A
+    numeral in an atom is the constant of its value. Both are read in the first-order
+    search only: a formula with no quantifier is propositional and keeps its atoms as
+    letters. Every parameter and every constant is one individual of each model, so a
+    formula with many of them searches larger models within the same ``max_steps``, and
+    a countermodel that needs a fresh individual beyond ``domain_elements`` (or more
+    valuations than ``max_steps``) is not found.
+
+    Many-sorted (``∀x:S`` / ``∃x:S`` / ``c:S``): relativized and given the classical
+    sort assumptions (no sort is empty, a sorted constant is in its sort) before the
+    search runs — see
+    :func:`_prepare_many_sorted` and the module docstring.
+
+    Raises:
+        NotImplementedError: a free variable is spelled like a constant of the formula
+            (the two would be one individual of the model), or a numeral like a
+            constant, or an identity atom occurs.
+        ValueError: second-order quantifiers or function terms occur, or an atom holds a
+            term that is neither a variable, a constant nor a numeral.
+    """
+    _reject_equality_everywhere(formula, "int_countermodel")
+    formula = _prepare_many_sorted(formula)
+    if _is_propositional(formula):
+        keys = _atom_keys(formula)
+        for n in range(1, max_worlds + 1):
+            for upset in _partial_orders(n):
+                for valuation in _monotone_valuations(upset, keys):
+                    model = IntKripkeModel(upset, valuation)
+                    for w in range(n):
+                        if not model.forces(w, formula):
+                            return model, w
+        return None
+    formula = _read_first_order_terms(formula)
+    return _fo_countermodel(formula, max_worlds, domain_elements, max_steps)
+
+
+def int_valid(formula: Node, max_worlds: int = 3,
+              domain_elements: int = 2, max_steps: int = 300000) -> bool:
+    """Return True iff ``formula`` is intuitionistically valid.
+
+    **Split contract** — the two fragments are decided differently, and honestly:
+
+    - **Propositional**: a genuine decision procedure, full stop, REGARDLESS of
+      ``max_worlds``. The bounded Kripke search (:func:`int_countermodel`) is tried
+      first as a fast path — a countermodel it finds within ``max_worlds`` worlds is a
+      real witness, so a quick ``False`` is returned without going further. But
+      propositional IPL's finite-model-property bound *grows with the formula* (e.g.
+      ``(p→q)∨(q→r)∨(r→p)`` needs 4 worlds — 3, the default, finds nothing), so
+      "no countermodel within the bound" is NOT by itself proof of validity. When the
+      bounded search comes up empty, the verdict is instead handed to
+      :func:`~unicode_logic_kit.atp.lj.int_prove` (Dyckhoff's contraction-free G4ip, a
+      terminating decision procedure with no bound to exhaust) for a DEFINITIVE
+      True-or-False answer. Net effect: both the ``True`` and the ``False`` verdicts on
+      a propositional formula are exact, at every ``max_worlds`` — including the
+      default. (Before this delegation, ``int_valid`` of the formula above wrongly
+      returned ``True`` at ``max_worlds=3``; see ``tests/test_lj_search.py`` for the
+      pinned regression.)
+    - **First-order**: a sound but *incomplete* check. ``True`` means "no
+      counter-model within the bounds" (not a proof, since first-order intuitionistic
+      validity is undecidable), while ``False`` is always backed by a real counter-model
+      from :func:`int_countermodel`. A free variable is a parameter, an individual that
+      exists in every world of the model, so ``∀x P(x) → P(y)`` is valid and
+      ``P(y) → ∃x Q(x)`` is not (see :func:`int_countermodel` and the module docstring).
+
+    Many-sorted (``∀x:S`` / ``∃x:S`` / ``c:S``): relativized and given the classical
+    sort assumptions (no sort is empty, a sorted constant is in its sort) before
+    either fragment's check runs (so a
+    formula that is many-sorted always takes the first-order branch above,
+    even if it would otherwise look propositional — see
+    :func:`_prepare_many_sorted` and the module docstring).
+
+    Raises:
+        NotImplementedError: as :func:`int_countermodel`.
+        ValueError: as :func:`int_countermodel`.
+    """
+    _reject_equality_everywhere(formula, "int_valid")
+    formula = _prepare_many_sorted(formula)
+    if not _is_propositional(formula):
+        return int_countermodel(formula, max_worlds, domain_elements, max_steps) is None
+    if int_countermodel(formula, max_worlds, domain_elements, max_steps) is not None:
+        return False
+    from ..atp.lj import int_prove   # lazy: avoids a semantics<->atp import cycle
+    return int_prove([], formula)