unicode-logic-kit 0.31.0__py3-none-any.whl

unicode_logic_kit/atp/resolution_check.py

@@ -0,0 +1,1114 @@
+"""Independent first-order resolution *proof checker* (not a searcher).
+
+Where :mod:`unicode_logic_kit.atp.resolution` *searches* for a refutation (given
+clause saturation, unification-driven), this module *certifies* one that was
+produced elsewhere: an external searcher — a research engine comparing
+calculi, a human, another prover — hands over a :class:`ResolutionDerivation`
+(a flat list of clauses each justified as an input clause, a binary resolvent,
+or a factor of an earlier clause) and :func:`verify_resolution_proof` decides,
+independently, whether every step genuinely follows. This is the same
+division of labour as :mod:`unicode_logic_kit.atp.fitch` (``check_proof``) and
+:mod:`unicode_logic_kit.atp.sequent` (``check_sequent_proof``): a derivation is
+only as trustworthy as its checker, so the checker must never share code with
+whatever produced the derivation.
+
+Clauses are represented exactly as :func:`unicode_logic_kit.atp.resolution.to_clauses`
+produces them: a clause is a ``frozenset`` of literals, each literal a kit
+:class:`~unicode_logic_kit.fol.nodes.Atom` (positive) or
+:class:`~unicode_logic_kit.fol.nodes.Not` wrapping one (negative); variables are
+implicitly universally quantified over the whole clause. Steps are 1-indexed in
+derivation order — ``step.index`` must equal its 1-based position in
+``derivation.steps`` — mirroring :mod:`atp.fitch`'s ``1..N`` line-numbering
+convention.
+
+Checking semantics (soundness is the only job; the searcher's search *strategy*
+— which pair it picked, in what order — is irrelevant and not reconstructed):
+
+- ``"input"`` (0 parents): the step's clause must be a *variant* (see below) of
+  one of ``derivation.inputs``.
+- ``"resolve"`` (2 parents ``i, j``, both ``< step.index``): the two parent
+  clauses are standardized apart (deterministic disjoint renaming — required
+  for soundness, since two clauses may share a variable name that names
+  logically unrelated individuals), and the step is accepted iff *some* pair
+  of complementary-polarity literals has unifiable atoms whose mgu, applied to
+  the union of the two remainder clauses, is a variant of the stated clause.
+- ``"factor"`` (1 parent ``i``): accepted iff *some* pair of same-polarity
+  literals in the parent unifies, and the mgu applied to the whole clause is a
+  variant of the stated clause.
+- ``"paramodulate"`` (2 parents ``i, j`` — ``i`` the equation, ``j`` the
+  rewrite target): unlike ``"resolve"``/``"factor"``, which search over EVERY
+  candidate literal pair, this rule and the two below require the
+  derivation to name its literals EXPLICITLY (``step.eq_literal``,
+  ``step.target_literal``, as they appear in the cited parents' OWN clauses —
+  not in some checker-internal renamed form) plus ``step.direction`` (``"lr"``
+  uses the equation's first argument as the rewrite source, ``"rl"`` the
+  second) and ``step.position`` (a tuple of argument indices addressing the
+  rewritten subterm of ``target_literal``'s atom). Nothing about the
+  UNIFIER is trusted or stored: the checker re-derives it from scratch by
+  unifying the equation's stated side against the subterm it extracts at
+  ``step.position``, and only accepts the step if that mgu, applied
+  everywhere, reproduces a variant of the stated clause. The two parents are
+  standardized apart first, exactly as for ``"resolve"``.
+  There is deliberately NO ``"self_paramodulate"`` rule: a shared-instance
+  shortcut (equation and target from ONE clause instantiation, both dropped)
+  is unsound — {u ≈ v, L[u]} would certify {L[v]}, false in a model that
+  satisfies the clause via L[u] alone with u ≠ v. A clause paramodulating
+  into itself must be certified as ``"paramodulate"`` with the clause cited
+  as BOTH parents (the checker standardizes the two citations apart).
+- ``"reflexivity"`` (1 parent ``i``): ``step.eq_literal`` must be a NEGATIVE
+  equality literal ``¬(u=v)`` of the cited clause whose two sides unify (own
+  ``_unify``); the mgu applied to the clause minus that literal must be a
+  variant of the stated clause.
+- ``"demodulate"`` (2 parents ``i, j`` — ``i`` the target, ``j`` a UNIT
+  equation clause): ``step.eq_literal`` must be the sole literal of the
+  cited unit clause ``j`` (a non-unit clause can never license an
+  unconditional rewrite — it only asserts a disjunction). Unlike
+  ``"paramodulate"``, the rewrite uses one-sided MATCHING, not unification
+  (the equation's stated side must literally instantiate, via its own free
+  variables only, the subterm at ``step.position`` — the target's variables
+  are never bound; the matcher is applied to the other side in ONE
+  simultaneous step, :func:`_apply_matcher`, because its images are terms of
+  the target and may be spelled like the equation's own variables), and the
+  orientation is re-checked with this module's own
+  term order (``_term_gt`` — see :mod:`atp.resolution`'s module docstring for
+  the order's definition): a direction that does not strictly decrease under
+  it is rejected, independent of what the derivation claims. No standardizing
+  apart is needed here (see the module's own note on that, near ``_match_term``).
+- ``"truth_constants"`` (1 parent ``i``): the stated clause is the cited clause
+  with some of its literals removed, and every removed literal is ``$false`` or
+  ``¬$true`` (false in every interpretation), so ``{$false}`` gives the empty
+  clause and ``{P, $false}`` gives ``{P}``; removing any other literal is
+  rejected.
+- The empty step list is ``ok=True, refuted=False`` (a derivation may verify
+  ok without proving anything); ``refuted`` is True iff some *successfully
+  verified* step's clause is empty, tracked independently of whether a later
+  step fails (so a bogus tail does not retroactively hide a genuine
+  refutation reached earlier).
+
+Two deliberate independence requirements (the checker's raison d'être — an
+external searcher must be certifiable *without trusting it*, and in particular
+without trusting any inference machinery it might also use):
+
+1. **Unification is reimplemented from scratch here** (:func:`_unify` /
+   :func:`_apply`, Robinson's algorithm with an occurs-check) instead of
+   importing :mod:`unicode_logic_kit.fol.unification`. A searcher built on top of
+   the kit's own ``unify`` must not be checked by the very same unification
+   code — a bug shared between searcher and checker would be invisible to
+   both. This is checker independence in the sense of Sicherheitsanforderungen
+   wie FA-5.2 des Zielprojekts: der Prüfer teilt keinen Code mit dem Sucher
+   ("the checker shares no code with the searcher"). ``tests/test_resolution_check.py``
+   holds a differential battery: on unifiable/non-unifiable atom pairs
+   (occurs-check both directions, function nesting, repeated variables),
+   :func:`_unify` and :func:`unicode_logic_kit.fol.unification.unify` must agree
+   on unifiability, and where both succeed each substitution must equalize its
+   own two atoms.
+2. **Variant (alpha-equivalence) checking is exact, not an approximation.**
+   Two clauses are *variants* iff there is a bijection between their literals
+   together with a bijection on variable names under which corresponding
+   literals become syntactically identical — this is implemented as an
+   explicit backtracking search over literal correspondences
+   (:func:`_is_variant`), not a canonical/sorted-form shortcut (which would be
+   wrong: e.g. sorting literals by a variable-name-sensitive key does not
+   commute with the variable renaming a real variant requires). This matters
+   because both ``"input"`` and the resolvent/factor of ``"resolve"``/``"factor"``
+   are checked *up to variant*, not up to literal `==`: a searcher's exact
+   choice of variable spelling must never cause a genuinely correct step to be
+   rejected, while a real structural mismatch (different arity, a constant
+   where a variable was needed, an unmatched literal) must still be caught.
+
+Public API: :class:`ResolutionStep`, :class:`ResolutionDerivation`,
+:class:`ResolutionCheckResult`, the checkers :func:`verify_resolution_proof` /
+:func:`check_resolution_proof`, and :func:`render_resolution_proof`.
+"""
+
+from dataclasses import dataclass
+from typing import Dict, FrozenSet, Optional, Tuple
+
+from ..fol._msfl_nodes import key_text
+from ..fol.nodes import Node, Atom, Not, Variable, Constant, Number, Function
+
+
+# ---------------------------------------------------------------------------
+# Derivation objects
+# ---------------------------------------------------------------------------
+
+@dataclass(frozen=True)
+class ResolutionStep:
+    """One line of a resolution derivation: a clause and how it was obtained.
+
+    ``rule`` is one of ``"input"`` (0 parents — the clause must be a variant
+    of one of the derivation's inputs), ``"resolve"`` (2 parents — a binary
+    resolvent of the two cited earlier clauses), ``"factor"`` (1 parent — a
+    factor of the one cited earlier clause), the three equality rules
+    ``"paramodulate"``/``"reflexivity"``/``"demodulate"``
+    (see the module docstring for each — including why a
+    ``"self_paramodulate"`` rule deliberately does NOT exist), or
+    ``"truth_constants"`` (1 parent — the cited clause with some of its literals
+    that are false in every interpretation, ``$false`` and ``¬$true``, removed).
+    ``parents``
+    holds the 1-based
+    ``index`` values of the cited earlier steps, in citation order (so for
+    ``"resolve"`` the pair is *not* order-sensitive — both orderings of the
+    complementary literal are tried by the checker; the equality rules
+    ARE order-sensitive — see below and the module docstring).
+
+    The four extra fields below are used only by the equality rules (and left
+    at their defaults — ``None``/``None``/``None``/``()`` — for
+    ``"input"``/``"resolve"``/``"factor"``, keeping old derivations valid
+    unchanged):
+
+    - ``eq_literal``: the equality-atom literal the step consumes, exactly as
+      it appears in its owning parent clause (parents[0] for
+      ``"paramodulate"``/``"reflexivity"``,
+      parents[1] for ``"demodulate"``) — POSITIVE for
+      ``"paramodulate"``/``"demodulate"``, NEGATIVE
+      for ``"reflexivity"``.
+    - ``target_literal``: the literal being rewritten (unused by
+      ``"reflexivity"``, which only ever removes ``eq_literal`` itself) —
+      for ``"paramodulate"``/``"demodulate"`` this is a literal of the OTHER
+      parent (parents[1]/parents[0] respectively).
+    - ``direction``: ``"lr"`` uses ``eq_literal``'s first argument as the
+      rewrite source and its second as the replacement, ``"rl"`` the reverse.
+    - ``position``: a tuple of argument indices addressing the rewritten
+      subterm within ``target_literal``'s atom (``()`` would address the
+      atom itself, never valid — a position always descends into at least
+      one argument first).
+
+    ``clause`` is coerced to a ``frozenset``, ``parents``/``position`` to
+    ``tuple``\\ s, so the step stays hashable.
+    """
+
+    index: int
+    clause: FrozenSet[Node]
+    rule: str
+    parents: Tuple[int, ...] = ()
+    eq_literal: Optional[Node] = None
+    target_literal: Optional[Node] = None
+    direction: Optional[str] = None
+    position: Tuple[int, ...] = ()
+
+    def __post_init__(self):
+        """Coerce ``clause``/``parents``/``position`` for hashability."""
+        object.__setattr__(self, "clause", frozenset(self.clause))
+        object.__setattr__(self, "parents", tuple(self.parents))
+        object.__setattr__(self, "position", tuple(self.position))
+
+
+@dataclass(frozen=True)
+class ResolutionDerivation:
+    """A full resolution derivation: the original clauses plus a proof of steps.
+
+    ``inputs`` is the set of clauses the ``"input"`` steps are licensed to
+    restate (up to variant) — typically the clausal form of the premises and
+    the negated conclusion, as :func:`unicode_logic_kit.atp.resolution.to_clauses`
+    would produce them, though the checker does not require or re-derive that
+    provenance; it only checks that every ``"input"`` step matches one of
+    them. ``steps`` is the ordered derivation body (see :class:`ResolutionStep`).
+    """
+
+    inputs: Tuple[FrozenSet[Node], ...] = ()
+    steps: Tuple[ResolutionStep, ...] = ()
+
+    def __post_init__(self):
+        """Coerce ``inputs`` to a tuple of frozensets and ``steps`` to a tuple."""
+        object.__setattr__(self, "inputs", tuple(frozenset(c) for c in self.inputs))
+        object.__setattr__(self, "steps", tuple(self.steps))
+
+
+@dataclass(frozen=True)
+class ResolutionCheckResult:
+    """The outcome of checking a derivation.
+
+    ``ok`` is True iff every step up to (and including) the point of failure —
+    i.e. every step, if there was no failure — is licensed by its rule.
+    ``error_index``/``error`` name the first offending step (``error`` in the
+    style ``"step N: reason"``) or are ``None`` on success. ``refuted`` is True
+    iff some *successfully verified* step derives the empty clause — computed
+    independently of ``ok``, so a refutation reached before a later malformed
+    step is still reported.
+    """
+
+    ok: bool
+    error_index: Optional[int]
+    error: Optional[str]
+    refuted: bool
+
+    def __bool__(self) -> bool:
+        """A ResolutionCheckResult is truthy iff the derivation checked out."""
+        return self.ok
+
+
+# ---------------------------------------------------------------------------
+# Independent unification (Robinson's algorithm, occurs-check) — see module
+# docstring, independence requirement 1: this must NOT import or call
+# unicode_logic_kit.fol.unification.unify. A substitution is a plain dict
+# mapping a variable NAME (str) to a term Node, exactly as in that module,
+# but every function below is a from-scratch reimplementation.
+# ---------------------------------------------------------------------------
+
+def _apply(node: Node, subst: Dict[str, Node]) -> Node:
+    """Apply ``subst`` to ``node``, following chained bindings, without mutation.
+
+    This reads a UNIFIER's output, whose bindings are triangular (``{x: y, y: a}`` says
+    ``x`` is ``a``), so the chain has to be followed. It is NOT how a one-sided matcher is
+    applied: the images of a matcher are terms of the target, and following them reads a
+    variable of the target as a variable of the pattern that happens to be spelled the
+    same (see :func:`_apply_matcher`).
+    """
+    if isinstance(node, Variable):
+        if node.name in subst:
+            return _apply(subst[node.name], subst)
+        return node
+    if isinstance(node, (Constant, Number)):
+        return node
+    if isinstance(node, Function):
+        return Function(node.name, [_apply(a, subst) for a in node.args])
+    if isinstance(node, Atom):
+        return Atom(node.predicate, [_apply(a, subst) for a in node.args])
+    raise TypeError(f"_apply: unsupported node type {type(node).__name__}")
+
+
+def _apply_literal(literal: Node, subst: Dict[str, Node]) -> Node:
+    """Apply ``subst`` to a literal (``Atom`` or ``Not(Atom)``), preserving polarity."""
+    if isinstance(literal, Not):
+        return Not(_apply(literal.formula, subst))
+    return _apply(literal, subst)
+
+
+def _apply_matcher(node: Node, matcher: Dict[str, Node]) -> Node:
+    """Apply the one-sided matcher ``matcher`` to ``node`` in ONE simultaneous step.
+
+    A matcher (:func:`_match_term`) maps each variable of the PATTERN to a subterm of the
+    TARGET. The target's own variables are held fixed, not bound, and nothing is standardized
+    apart, so an image may mention a variable spelled like one the matcher binds: the
+    pattern ``f(x, y)`` against ``f(y, z)`` gives ``{x: y, y: z}``, and the instance of
+    ``g(x)`` is ``g(y)``, with that ``y`` the target's. An image is a finished term and is
+    never looked up again; :func:`_apply` would read it as the pattern's ``y`` and answer
+    ``g(z)``, and it would not end on ``{x: y, y: x}`` or ``{y: y}`` (a matcher that
+    is cyclic, or that binds a variable to itself, both arise from a rule matched against a
+    clause that shares its variable names).
+
+    A variable the matcher does not bind is left as it is, and so is every other leaf.
+    """
+    if isinstance(node, Variable):
+        return matcher.get(node.name, node)
+    if isinstance(node, (Constant, Number)):
+        return node
+    if isinstance(node, Function):
+        return Function(node.name, tuple(_apply_matcher(a, matcher) for a in node.args))
+    if isinstance(node, Atom):
+        return Atom(node.predicate, tuple(_apply_matcher(a, matcher) for a in node.args))
+    raise TypeError(f"_apply_matcher: unsupported node type {type(node).__name__}")
+
+
+def _occurs(name: str, term: Node, subst: Dict[str, Node]) -> bool:
+    """Return True iff variable ``name`` occurs in ``term`` after applying ``subst``.
+
+    The occurs-check: rejects a binding such as ``x ↦ f(x)`` that would build
+    an infinite (cyclic) term.
+    """
+    term = _apply(term, subst)
+    if isinstance(term, Variable):
+        return term.name == name
+    if isinstance(term, Function):
+        return any(_occurs(name, a, subst) for a in term.args)
+    return False
+
+
+def _bind(name: str, term: Node, subst: Dict[str, Node]) -> Optional[Dict[str, Node]]:
+    """Extend ``subst`` with ``name ↦ term`` (occurs-checked); returns a new dict or None.
+
+    Binding a variable to itself is a no-op that returns ``subst`` unchanged.
+    """
+    if isinstance(term, Variable) and term.name == name:
+        return subst
+    if _occurs(name, term, subst):
+        return None
+    new_subst = dict(subst)
+    new_subst[name] = _apply(term, subst)
+    return new_subst
+
+
+def _leaf_value(node: Node):
+    """Return the comparable payload of a leaf node (Constant name / Number value)."""
+    if isinstance(node, Constant):
+        return node.name
+    if isinstance(node, Number):
+        return node.value
+    return None
+
+
+def _unify_args(args1, args2, subst: Dict[str, Node]) -> Optional[Dict[str, Node]]:
+    """Unify two equal-length argument lists left-to-right, threading ``subst``."""
+    for a, b in zip(args1, args2):
+        subst = _unify(a, b, subst)
+        if subst is None:
+            return None
+    return subst
+
+
+def _unify(t1: Node, t2: Node, subst: Optional[Dict[str, Node]] = None) -> Optional[Dict[str, Node]]:
+    """Most general unifier of ``t1`` and ``t2``, or None (Robinson, occurs-checked).
+
+    Independent reimplementation of :func:`unicode_logic_kit.fol.unification.unify`
+    (see module docstring, independence requirement 1) — same term language
+    (``Variable``/``Constant``/``Number``/``Function``, plus ``Atom`` for the
+    literal case) and the same algorithm, but sharing no code with it.
+    """
+    if subst is None:
+        subst = {}
+
+    t1 = _apply(t1, subst)
+    t2 = _apply(t2, subst)
+
+    if isinstance(t1, Variable):
+        return _bind(t1.name, t2, subst)
+    if isinstance(t2, Variable):
+        return _bind(t2.name, t1, subst)
+
+    if isinstance(t1, (Constant, Number)) or isinstance(t2, (Constant, Number)):
+        if type(t1) is type(t2) and _leaf_value(t1) == _leaf_value(t2):
+            return subst
+        return None
+
+    if isinstance(t1, Function) and isinstance(t2, Function):
+        if t1.name != t2.name or len(t1.args) != len(t2.args):
+            return None
+        return _unify_args(t1.args, t2.args, subst)
+
+    if isinstance(t1, Atom) and isinstance(t2, Atom):
+        if t1.predicate != t2.predicate or len(t1.args) != len(t2.args):
+            return None
+        return _unify_args(t1.args, t2.args, subst)
+
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Exact variant (alpha-equivalence) checking — see module docstring,
+# independence requirement 2: a backtracking search for a literal
+# correspondence plus a variable-name BIJECTION, not a canonical-form
+# shortcut.
+# ---------------------------------------------------------------------------
+
+def _term_alpha_match(t1: Node, t2: Node, fwd: Dict[str, str], bwd: Dict[str, str]):
+    """Try to extend the variable bijection ``(fwd, bwd)`` matching ``t1`` (A-side)
+    onto ``t2`` (B-side); returns the extended ``(fwd, bwd)`` pair or None.
+
+    ``fwd``/``bwd`` map A-variable-name -> B-variable-name and back; neither
+    input dict is mutated (a matched extension is a fresh copy), so a failed
+    branch never corrupts an earlier partial match a backtracking caller may
+    still want to try again on a different literal.
+    """
+    if isinstance(t1, Variable) and isinstance(t2, Variable):
+        mapped = fwd.get(t1.name)
+        if mapped is not None:
+            return (fwd, bwd) if mapped == t2.name else None
+        if t2.name in bwd:
+            return None  # t2 already claimed by a different A-variable: not injective
+        new_fwd = dict(fwd)
+        new_fwd[t1.name] = t2.name
+        new_bwd = dict(bwd)
+        new_bwd[t2.name] = t1.name
+        return new_fwd, new_bwd
+    if isinstance(t1, Variable) or isinstance(t2, Variable):
+        return None  # a variable can only match a variable — constants are not variables
+    if isinstance(t1, Constant) and isinstance(t2, Constant):
+        return (fwd, bwd) if t1.name == t2.name else None
+    if isinstance(t1, Number) and isinstance(t2, Number):
+        return (fwd, bwd) if t1.value == t2.value else None
+    if isinstance(t1, Function) and isinstance(t2, Function):
+        if t1.name != t2.name or len(t1.args) != len(t2.args):
+            return None
+        for a1, a2 in zip(t1.args, t2.args):
+            res = _term_alpha_match(a1, a2, fwd, bwd)
+            if res is None:
+                return None
+            fwd, bwd = res
+        return fwd, bwd
+    return None  # mismatched node kinds (e.g. Constant vs Number)
+
+
+def _lit_alpha_match(l1: Node, l2: Node, fwd: Dict[str, str], bwd: Dict[str, str]):
+    """As :func:`_term_alpha_match`, but for a whole literal (``Atom``/``Not(Atom)``).
+
+    Polarity must match, and the underlying atoms' predicate and arity must
+    match, before any variable matching is attempted.
+    """
+    neg1, neg2 = isinstance(l1, Not), isinstance(l2, Not)
+    if neg1 != neg2:
+        return None
+    a1 = l1.formula if neg1 else l1
+    a2 = l2.formula if neg2 else l2
+    if not (isinstance(a1, Atom) and isinstance(a2, Atom)):
+        return None
+    if a1.predicate != a2.predicate or len(a1.args) != len(a2.args):
+        return None
+    for x, y in zip(a1.args, a2.args):
+        res = _term_alpha_match(x, y, fwd, bwd)
+        if res is None:
+            return None
+        fwd, bwd = res
+    return fwd, bwd
+
+
+def _is_variant(a: FrozenSet[Node], b: FrozenSet[Node]) -> bool:
+    """Return True iff clause ``a`` is a variant (alpha-equivalent copy) of clause ``b``.
+
+    Backtracking search for a bijection between the literals of ``a`` and
+    ``b`` together with a bijection on variable names under which every
+    matched literal pair becomes syntactically identical. Deliberately exact
+    (not a sorted/canonical-form shortcut — see the module docstring): e.g.
+    ``{P(x,y), P(y,x)}`` IS a variant of ``{P(u,v), P(v,u)}`` (a 2-cycle
+    literal correspondence with a 2-variable bijection), ``{P(x,x)}`` is NOT a
+    variant of ``{P(x,y)}`` (no single variable can equal two distinct ones),
+    and ``{P(x)}`` is NOT a variant of ``{P(a)}`` (a constant is never matched
+    by a variable). Worst case is factorial in clause size, which is fine for
+    the small clauses resolution steps actually produce.
+    """
+    la, lb = list(a), list(b)
+    if len(la) != len(lb):
+        return False
+    used = [False] * len(lb)
+
+    def backtrack(i: int, fwd: Dict[str, str], bwd: Dict[str, str]) -> bool:
+        if i == len(la):
+            return True
+        for j in range(len(lb)):
+            if used[j]:
+                continue
+            res = _lit_alpha_match(la[i], lb[j], fwd, bwd)
+            if res is None:
+                continue
+            used[j] = True
+            if backtrack(i + 1, res[0], res[1]):
+                return True
+            used[j] = False
+        return False
+
+    return backtrack(0, {}, {})
+
+
+# ---------------------------------------------------------------------------
+# Standardizing apart (deterministic disjoint renaming of two clauses)
+# ---------------------------------------------------------------------------
+
+def _clause_var_names(clause: FrozenSet[Node]) -> set:
+    """Return the set of variable names occurring anywhere in ``clause``."""
+    names = set()
+    for literal in clause:
+        for n in literal.walk():
+            if isinstance(n, Variable):
+                names.add(n.name)
+    return names
+
+
+def _rename_term(node: Node, mapping: Dict[str, Variable]) -> Node:
+    """Return ``node`` with each Variable renamed via the one-level ``mapping``."""
+    if isinstance(node, Variable):
+        return mapping.get(node.name, node)
+    if isinstance(node, (Constant, Number)):
+        return node
+    if isinstance(node, Function):
+        return Function(node.name, [_rename_term(a, mapping) for a in node.args])
+    if isinstance(node, Atom):
+        return Atom(node.predicate, [_rename_term(a, mapping) for a in node.args])
+    raise TypeError(f"_rename_term: unsupported node type {type(node).__name__}")
+
+
+def _rename_literal(literal: Node, mapping: Dict[str, Variable]) -> Node:
+    """Return ``literal`` with each Variable renamed via the one-level ``mapping``."""
+    if isinstance(literal, Not):
+        return Not(_rename_term(literal.formula, mapping))
+    return _rename_term(literal, mapping)
+
+
+def _standardize_apart_maps(ca: FrozenSet[Node], cb: FrozenSet[Node]):
+    """As :func:`_standardize_apart`, but also returns the two rename maps
+    (original variable name -> fresh :class:`Variable`) used to build the
+    standardized-apart clauses.
+
+    Needed by ``"paramodulate"`` (not
+    ``"demodulate"``, which needs no standardizing apart — see its checker):
+    a derivation names ``eq_literal``/``target_literal`` exactly as they
+    appear in the ORIGINAL (pre-rename) parent clauses, so the checker must
+    replay the SAME rename to find their counterparts in the standardized
+    clauses it works with.
+    """
+    names_a = sorted(_clause_var_names(ca))
+    names_b = sorted(_clause_var_names(cb))
+    map_a = {name: Variable(f"_L{i}") for i, name in enumerate(names_a)}
+    map_b = {name: Variable(f"_R{i}") for i, name in enumerate(names_b)}
+    new_a = frozenset(_rename_literal(lit, map_a) for lit in ca)
+    new_b = frozenset(_rename_literal(lit, map_b) for lit in cb)
+    return new_a, new_b, map_a, map_b
+
+
+def _standardize_apart(ca: FrozenSet[Node], cb: FrozenSet[Node]):
+    """Rename the variables of ``ca`` and ``cb`` to disjoint fresh names.
+
+    A soundness requirement before resolving two clauses: each clause's
+    variables are implicitly universally quantified *over that clause alone*,
+    so a name they happen to share (e.g. both using ``x``) names logically
+    unrelated individuals and must not be conflated. Renaming is deterministic
+    (sorted by original name, prefixed ``_L``/``_R``) so the check is
+    reproducible; the *choice* of fresh names is otherwise immaterial since
+    every candidate resolvent is compared up to variant, not up to `==`. A
+    thin wrapper over :func:`_standardize_apart_maps` that drops the maps,
+    for callers (``"resolve"``) that don't need to translate a
+    pre-standardization literal reference.
+    """
+    new_a, new_b, _map_a, _map_b = _standardize_apart_maps(ca, cb)
+    return new_a, new_b
+
+
+# ---------------------------------------------------------------------------
+# Literal polarity
+# ---------------------------------------------------------------------------
+
+def _lit_atom_polarity(literal: Node) -> Optional[Tuple[Atom, bool]]:
+    """Return ``(atom, is_positive)`` for a well-formed literal, or None.
+
+    A well-formed literal is a bare ``Atom`` (positive) or a ``Not`` wrapping
+    exactly one (negative); anything else (e.g. a doubly-negated or non-atomic
+    literal) is not a legal clause literal and is returned as None so callers
+    can skip it rather than crash — a malformed clause simply matches nothing.
+    """
+    if isinstance(literal, Not) and isinstance(literal.formula, Atom):
+        return literal.formula, False
+    if isinstance(literal, Atom):
+        return literal, True
+    return None
+
+
+def _lit_key(literal: Node) -> str:
+    """Canonical sort key for a literal (its surface form with every constant written by its
+    bare name, ``key_text``): search order over a
+    clause's literals must be a function of CONTENT, not of frozenset iteration
+    order (hash-randomised across processes), so the checker's behaviour and
+    :func:`render_resolution_proof`'s output are reproducible run to run. The quotes that the
+    text of a formula puts around a constant play no part in the order."""
+    return key_text(literal)
+
+
+# ---------------------------------------------------------------------------
+# Equality: an INDEPENDENT reimplementation of the term order, one-sided term
+# matching, and subterm positions/replacement used by the four equality
+# rules below. Independence requirement 1 (see the module docstring) applies
+# here exactly as it does to _unify/_apply: this module must reach the SAME
+# verdicts as unicode_logic_kit.atp.resolution's own _term_gt/_match_term/
+# _term_at/_replace_at on any given input, but shares no code with them.
+# ---------------------------------------------------------------------------
+
+def _is_equality_atom(atom: Atom) -> bool:
+    """True iff atom is a binary ``=`` atom."""
+    return atom.predicate == "=" and len(atom.args) == 2
+
+
+def _term_weight(term: Node) -> int:
+    """Term order, part 1 — WEIGHT (term size): 1 for a leaf
+    (Variable/Constant/Number), 1 + the sum of its arguments' weights for a
+    Function. Must be the SAME definition as
+    :func:`unicode_logic_kit.atp.resolution._term_weight` (both sides need to
+    reach the same orientation verdict on any given equation), reimplemented
+    independently here."""
+    if isinstance(term, Function):
+        return 1 + sum(_term_weight(a) for a in term.args)
+    return 1
+
+
+def _term_order_key(term: Node):
+    """Term order, part 2 — ties in weight broken lexicographically by the
+    term's rendering with every constant written by its bare name (``key_text``)."""
+    return (_term_weight(term), key_text(term))
+
+
+def _term_gt(s: Node, t: Node) -> bool:
+    """True iff ``s`` is STRICTLY greater than ``t`` under the module's term
+    order (weight, then lexicographic tie-break). See
+    :mod:`unicode_logic_kit.atp.resolution`'s module docstring ("Equality"
+    section) for the full definition and the soundness argument for why
+    checking this on concretely SUBSTITUTED terms (as ``"demodulate"``'s
+    checker does) needs no substitution-compatibility closure."""
+    return _term_order_key(s) > _term_order_key(t)
+
+
+def _match_term(pattern: Node, target: Node, subst: Dict[str, Node]) -> Optional[Dict[str, Node]]:
+    """One-sided structural match of ``pattern`` against ``target``: PATTERN's
+    variables may bind, TARGET is held fixed (its own variables, if any, are
+    opaque — never instantiated). A repeated pattern variable must match the
+    same target subterm everywhere (checked by structural equality against
+    the existing binding). Returns the extended substitution, or None on
+    failure. The result is applied with :func:`_apply_matcher`, never with
+    :func:`_apply`. Used only by ``"demodulate"``'s checker, to re-derive whether
+    the cited equation's stated side genuinely matches the target subterm —
+    an independent reimplementation of the same one-sided-matching idea
+    :mod:`unicode_logic_kit.atp.resolution` uses for both subsumption and its
+    own demodulation (:func:`~unicode_logic_kit.atp.resolution._match_term`),
+    sharing no code with it.
+    """
+    if isinstance(pattern, Variable):
+        if pattern.name in subst:
+            return subst if subst[pattern.name] == target else None
+        extended = dict(subst)
+        extended[pattern.name] = target
+        return extended
+    if isinstance(pattern, Function):
+        if (not isinstance(target, Function)
+                or pattern.name != target.name
+                or len(pattern.args) != len(target.args)):
+            return None
+        for p_arg, t_arg in zip(pattern.args, target.args):
+            subst = _match_term(p_arg, t_arg, subst)
+            if subst is None:
+                return None
+        return subst
+    return subst if pattern == target else None
+
+
+def _term_at(node: Node, position: Tuple[int, ...]) -> Node:
+    """Walk ``position`` (a tuple of argument indices) from ``node`` down to
+    the addressed subterm. Raises ``IndexError``/``AttributeError``/
+    ``TypeError`` on an invalid path (out-of-range index, or descending past
+    a leaf) — callers catch these and turn them into a proper
+    ``"step N: ..."`` error, exactly the outcome a TAMPERED position (one of
+    the derivation manipulations these checkers must catch) should produce.
+    """
+    for i in position:
+        node = node.args[i]
+    return node
+
+
+def _replace_at(node: Node, position: Tuple[int, ...], replacement: Node) -> Node:
+    """Return a copy of ``node`` (an :class:`Atom` or :class:`Function`) with
+    the subterm at ``position`` replaced by ``replacement``. Raises the same
+    exceptions as :func:`_term_at` on an invalid path."""
+    if not position:
+        return replacement
+    i, rest = position[0], position[1:]
+    new_args = list(node.args)
+    new_args[i] = _replace_at(node.args[i], rest, replacement)
+    if isinstance(node, Atom):
+        return Atom(node.predicate, new_args)
+    return Function(node.name, new_args)
+
+
+# ---------------------------------------------------------------------------
+# Per-rule step checkers: each returns None (licensed) or an error string
+# (WITHOUT the "step N: " prefix, added by the caller).
+# ---------------------------------------------------------------------------
+
+def _check_input_step(step: ResolutionStep, inputs: Tuple[FrozenSet[Node], ...]) -> Optional[str]:
+    """``"input"``: the clause must be a variant of one of ``inputs``."""
+    for inp in inputs:
+        if _is_variant(step.clause, inp):
+            return None
+    return "'input' clause is not a variant (alpha-equivalent copy) of any derivation input"
+
+
+def _check_resolve_step(step: ResolutionStep, ci: FrozenSet[Node], cj: FrozenSet[Node]) -> Optional[str]:
+    """``"resolve"``: some complementary-polarity literal pair's mgu must give the clause."""
+    ci2, cj2 = _standardize_apart(ci, cj)
+    found_complementary_pair = False
+    for lit1 in sorted(ci2, key=_lit_key):
+        parsed1 = _lit_atom_polarity(lit1)
+        if parsed1 is None:
+            continue
+        atom1, pos1 = parsed1
+        for lit2 in sorted(cj2, key=_lit_key):
+            parsed2 = _lit_atom_polarity(lit2)
+            if parsed2 is None:
+                continue
+            atom2, pos2 = parsed2
+            if pos1 == pos2:
+                continue
+            found_complementary_pair = True
+            sigma = _unify(atom1, atom2)
+            if sigma is None:
+                continue
+            resolvent = frozenset(
+                [_apply_literal(l, sigma) for l in ci2 if l != lit1]
+                + [_apply_literal(l, sigma) for l in cj2 if l != lit2]
+            )
+            if _is_variant(resolvent, step.clause):
+                return None
+    if not found_complementary_pair:
+        return "'resolve': the parent clauses contain no complementary-polarity literal pair"
+    return ("'resolve': no complementary-polarity literal pair's mgu produces "
+            "the stated resolvent clause")
+
+
+def _check_factor_step(step: ResolutionStep, ci: FrozenSet[Node]) -> Optional[str]:
+    """``"factor"``: some same-polarity literal pair's mgu must give the clause."""
+    literals = sorted(ci, key=_lit_key)
+    for a in range(len(literals)):
+        parsed_a = _lit_atom_polarity(literals[a])
+        if parsed_a is None:
+            continue
+        atom_a, pos_a = parsed_a
+        for b in range(a + 1, len(literals)):
+            parsed_b = _lit_atom_polarity(literals[b])
+            if parsed_b is None:
+                continue
+            atom_b, pos_b = parsed_b
+            if pos_a != pos_b:
+                continue
+            sigma = _unify(atom_a, atom_b)
+            if sigma is None:
+                continue
+            factored = frozenset(_apply_literal(l, sigma) for l in ci)
+            if _is_variant(factored, step.clause):
+                return None
+    return ("'factor': no same-polarity literal pair's mgu produces the "
+            "stated factored clause")
+
+
+def _direction_sides(eq_atom: Atom, direction: Optional[str]):
+    """Return ``(from, to)`` for a ``"lr"``/``"rl"`` direction over
+    ``eq_atom``'s two arguments, or ``None`` for any other value (including
+    a missing direction) -- shared by all four equality-rule checkers below."""
+    if direction == "lr":
+        return eq_atom.args[0], eq_atom.args[1]
+    if direction == "rl":
+        return eq_atom.args[1], eq_atom.args[0]
+    return None
+
+
+def _check_paramodulate_step(step: ResolutionStep, ci: FrozenSet[Node], cj: FrozenSet[Node]) -> Optional[str]:
+    """``"paramodulate"``: parents ``(i, j)`` -- ``i`` supplies a positive
+    equality literal (``step.eq_literal``, oriented by ``step.direction``),
+    ``j`` supplies the target literal (``step.target_literal``) rewritten at
+    ``step.position``. Re-derived from scratch: the two parents are
+    standardized apart (as for ``"resolve"``); the declared eq_literal/
+    target_literal (named as they appear in the ORIGINAL parents) are
+    located in the standardized clauses via the SAME rename maps; the
+    subterm at ``step.position`` is extracted from the target atom and
+    unified (own ``_unify``) against the equation's stated side; the
+    resulting mgu, applied to both remainders plus the rewritten literal, is
+    compared up to variant against the stated clause -- resolve's recipe,
+    generalized to a rewrite instead of a literal cancellation.
+    """
+    if step.eq_literal is None or step.target_literal is None:
+        return "'paramodulate' requires eq_literal and target_literal"
+    ci2, cj2, map_i, map_j = _standardize_apart_maps(ci, cj)
+    eq_lit = _rename_literal(step.eq_literal, map_i)
+    if eq_lit not in ci2:
+        return "'paramodulate': eq_literal is not present in the cited equation parent"
+    parsed_eq = _lit_atom_polarity(eq_lit)
+    if parsed_eq is None or not parsed_eq[1]:
+        return "'paramodulate': eq_literal must be a POSITIVE equality literal"
+    eq_atom, _pos = parsed_eq
+    if not _is_equality_atom(eq_atom):
+        return "'paramodulate': eq_literal is not a binary equality atom"
+    sides = _direction_sides(eq_atom, step.direction)
+    if sides is None:
+        return "'paramodulate' requires direction 'lr' or 'rl'"
+    frm, to = sides
+
+    tgt_lit = _rename_literal(step.target_literal, map_j)
+    if tgt_lit not in cj2:
+        return "'paramodulate': target_literal is not present in the cited target parent"
+    parsed_tgt = _lit_atom_polarity(tgt_lit)
+    if parsed_tgt is None:
+        return "'paramodulate': target_literal is not a well-formed literal"
+    tgt_atom, tgt_is_positive = parsed_tgt
+
+    try:
+        subterm = _term_at(tgt_atom, step.position)
+    except (IndexError, TypeError, AttributeError):
+        return "'paramodulate': position does not address a subterm of target_literal"
+
+    sigma = _unify(frm, subterm)
+    if sigma is None:
+        return "'paramodulate': the equation's stated side does not unify with the subterm at position"
+
+    try:
+        rewritten_atom = _replace_at(tgt_atom, step.position, to)
+    except (IndexError, TypeError, AttributeError):
+        return "'paramodulate': position does not address a replaceable subterm"
+    rewritten_lit = rewritten_atom if tgt_is_positive else Not(rewritten_atom)
+
+    expected = frozenset(
+        [_apply_literal(l, sigma) for l in ci2 if l != eq_lit]
+        + [_apply_literal(l, sigma) for l in cj2 if l != tgt_lit]
+        + [_apply_literal(rewritten_lit, sigma)]
+    )
+    if _is_variant(expected, step.clause):
+        return None
+    return "'paramodulate': the recomputed rewrite is not a variant of the stated clause"
+
+
+def _check_reflexivity_step(step: ResolutionStep, ci: FrozenSet[Node]) -> Optional[str]:
+    """``"reflexivity"``: drops a NEGATIVE equality literal ``¬(u=v)`` from
+    the cited clause once its own two sides unify (own ``_unify``,
+    occurs-checked); the resulting mgu is applied to what remains. Covers
+    reflexivity goals such as ``⊢ c=c``, whose negation clausifies to
+    ``{¬(c=c)}`` (unified by the trivial mgu ``{}``).
+    """
+    if step.eq_literal is None:
+        return "'reflexivity' requires eq_literal"
+    if step.eq_literal not in ci:
+        return "'reflexivity': eq_literal is not present in the cited parent"
+    parsed = _lit_atom_polarity(step.eq_literal)
+    if parsed is None or parsed[1]:
+        return "'reflexivity': eq_literal must be a NEGATIVE equality literal"
+    atom, _pos = parsed
+    if not _is_equality_atom(atom):
+        return "'reflexivity': eq_literal is not a binary equality atom"
+    u, v = atom.args
+    sigma = _unify(u, v)
+    if sigma is None:
+        return "'reflexivity': the two sides of eq_literal do not unify"
+    expected = frozenset(_apply_literal(l, sigma) for l in ci if l != step.eq_literal)
+    if _is_variant(expected, step.clause):
+        return None
+    return "'reflexivity': the recomputed clause is not a variant of the stated clause"
+
+
+def _check_demodulate_step(step: ResolutionStep, ci: FrozenSet[Node], cj: FrozenSet[Node]) -> Optional[str]:
+    """``"demodulate"``: parents ``(target i, unit-equation j)``. ``cj`` must
+    be a UNIT clause (a single literal) whose sole literal is
+    ``step.eq_literal``, a positive equality literal used as a REWRITE RULE
+    via one-sided MATCHING (:func:`_match_term` -- not unification: the
+    rule's variables bind, the target clause's variables are held fixed)
+    against the subterm of ``step.target_literal`` in ``ci`` at
+    ``step.position``. The orientation is re-checked on the CONCRETE,
+    substituted terms with this module's own term order (:func:`_term_gt`):
+    only a genuinely simplifying rewrite (subterm ≻ rσ) is accepted -- a
+    tampered direction against the order is rejected here, independent of
+    what the derivation claims. No standardizing apart is needed: one-sided
+    matching never binds a target-side variable, so a coincidental variable
+    name shared between ``ci`` and ``cj`` cannot cause capture (the same
+    reasoning :mod:`unicode_logic_kit.atp.resolution` relies on for its own
+    demodulation and for clause subsumption, neither of which standardizes
+    apart either). The matcher is applied to the right-hand side in ONE
+    simultaneous step (:func:`_apply_matcher`): its images are terms of the
+    target, which may be spelled like the equation's variables, so they are
+    not looked up again.
+
+    The non-unit restriction on ``cj`` is a soundness requirement, not a
+    convenience: a clause ``{u≈v, Q}`` only asserts ``u≈v ∨ Q``, not the
+    unconditional fact ``u≈v`` -- rewriting with it while discarding ``Q``
+    would be unsound.
+    """
+    if step.eq_literal is None or step.target_literal is None:
+        return "'demodulate' requires eq_literal and target_literal"
+    if len(cj) != 1:
+        return "'demodulate': the equation parent must be a UNIT clause (a single positive equality literal)"
+    if step.eq_literal not in cj:
+        return "'demodulate': eq_literal is not present in the cited equation parent"
+    parsed_eq = _lit_atom_polarity(step.eq_literal)
+    if parsed_eq is None or not parsed_eq[1]:
+        return "'demodulate': eq_literal must be a POSITIVE equality literal"
+    eq_atom, _pos = parsed_eq
+    if not _is_equality_atom(eq_atom):
+        return "'demodulate': eq_literal is not a binary equality atom"
+    sides = _direction_sides(eq_atom, step.direction)
+    if sides is None:
+        return "'demodulate' requires direction 'lr' or 'rl'"
+    l, r = sides
+
+    if step.target_literal not in ci:
+        return "'demodulate': target_literal is not present in the cited target parent"
+    parsed_tgt = _lit_atom_polarity(step.target_literal)
+    if parsed_tgt is None:
+        return "'demodulate': target_literal is not a well-formed literal"
+    tgt_atom, tgt_is_positive = parsed_tgt
+
+    try:
+        subterm = _term_at(tgt_atom, step.position)
+    except (IndexError, TypeError, AttributeError):
+        return "'demodulate': position does not address a subterm of target_literal"
+
+    sigma = _match_term(l, subterm, {})
+    if sigma is None:
+        return "'demodulate': the equation's stated left side does not MATCH the subterm at position"
+
+    r_sigma = _apply_matcher(r, sigma)
+    if not _term_gt(subterm, r_sigma):
+        return "'demodulate': the orientation does not strictly decrease under the documented term order"
+
+    try:
+        rewritten_atom = _replace_at(tgt_atom, step.position, r_sigma)
+    except (IndexError, TypeError, AttributeError):
+        return "'demodulate': position does not address a replaceable subterm"
+    rewritten_lit = rewritten_atom if tgt_is_positive else Not(rewritten_atom)
+
+    rest = [l2 for l2 in ci if l2 != step.target_literal]
+    expected = frozenset(rest + [rewritten_lit])
+    if _is_variant(expected, step.clause):
+        return None
+    return "'demodulate': the recomputed clause is not a variant of the stated clause"
+
+
+def _is_false_constant_literal(literal: Node) -> bool:
+    """True iff ``literal`` holds in no interpretation: the truth constant ``$false``
+    (or the atom ``⊥``) or the negation of the truth constant ``$true`` (or ``⊤``)
+    (re-derived here from the names, like the rest of this checker's vocabulary).
+    ``$true`` and ``¬$false`` are NOT false: nothing may be removed because of them."""
+    if isinstance(literal, Not):
+        inner = literal.formula
+        return isinstance(inner, Atom) and not inner.args and inner.predicate in ("$true", "⊤")
+    return isinstance(literal, Atom) and not literal.args and literal.predicate in ("$false", "⊥")
+
+
+def _check_truth_constants_step(step: ResolutionStep, ci: FrozenSet[Node]) -> Optional[str]:
+    """``"truth_constants"``: from the cited clause, drop literals that are false in
+    every interpretation (``$false`` and ``¬$true``).
+
+    The stated clause must be a SUBSET of the cited one and every literal missing
+    from it must be such a constant, so ``C ∨ $false`` gives ``C`` and nothing
+    else is licensed: a literal of any other atom, ``$true`` and ``¬$false`` stay
+    (a clause that has those is simply true, which no step has to derive).
+    """
+    if not step.clause <= ci:
+        return "'truth_constants': the stated clause must be a subset of the cited clause"
+    for literal in ci - step.clause:
+        if not _is_false_constant_literal(literal):
+            return (f"'truth_constants': {literal.to_unicode_str()!r} is not a literal "
+                    "that is false in every interpretation ($false or ¬$true)")
+    return None
+
+
+_RULE_ARITY = {
+    "input": 0, "resolve": 2, "factor": 1,
+    "paramodulate": 2, "reflexivity": 1, "demodulate": 2,
+    "truth_constants": 1,
+}
+# NO "self_paramodulate": the shared-instance shortcut (equation and target
+# from ONE instantiation, both dropped) is UNSOUND — for {u ≈ v, L[u]} it
+# would certify {L[v]}, false in a model satisfying the clause via L[u] with
+# u ≠ v. The generator no longer emits it (adversarial review, Tier 3), and
+# an external derivation claiming it must be REJECTED, not re-derived.
+
+
+# ---------------------------------------------------------------------------
+# The checker
+# ---------------------------------------------------------------------------
+
+def verify_resolution_proof(derivation: "ResolutionDerivation") -> ResolutionCheckResult:
+    """Check ``derivation`` and return a :class:`ResolutionCheckResult`.
+
+    Walks ``derivation.steps`` in order, verifying each step's structural
+    shape (index == position, parents strictly earlier, parent count matches
+    the rule) and then its rule-specific licensing (see the module docstring).
+    Stops at the first failure and reports it as ``"step N: reason"``.
+    ``refuted`` tracks, independently of ``ok``, whether some step verified
+    *before* any failure derives the empty clause.
+    """
+    clause_by_index: Dict[int, FrozenSet[Node]] = {}
+    refuted = False
+
+    for pos, step in enumerate(derivation.steps):
+        expected_index = pos + 1
+        if not isinstance(step, ResolutionStep):
+            return ResolutionCheckResult(
+                False, None,
+                f"step {expected_index}: expected a ResolutionStep, got "
+                f"{type(step).__name__}",
+                refuted)
+        if step.index != expected_index:
+            return ResolutionCheckResult(
+                False, step.index,
+                f"step {step.index}: index must equal its position in the "
+                f"derivation (expected {expected_index})",
+                refuted)
+
+        arity = _RULE_ARITY.get(step.rule)
+        if arity is None:
+            expected = ", ".join(repr(r) for r in _RULE_ARITY)
+            return ResolutionCheckResult(
+                False, step.index,
+                f"step {step.index}: unknown rule {step.rule!r} (expected "
+                f"one of {expected})",
+                refuted)
+        if len(step.parents) != arity:
+            return ResolutionCheckResult(
+                False, step.index,
+                f"step {step.index}: rule {step.rule!r} takes {arity} "
+                f"parent(s), got {len(step.parents)}",
+                refuted)
+
+        for p in step.parents:
+            if p not in clause_by_index or p >= step.index:
+                return ResolutionCheckResult(
+                    False, step.index,
+                    f"step {step.index}: parent {p} does not refer to a "
+                    f"strictly earlier verified step (parents must cite "
+                    f"smaller indices)",
+                    refuted)
+
+        if step.rule == "input":
+            err = _check_input_step(step, derivation.inputs)
+        elif step.rule == "resolve":
+            i, j = step.parents
+            err = _check_resolve_step(step, clause_by_index[i], clause_by_index[j])
+        elif step.rule == "factor":
+            (i,) = step.parents
+            err = _check_factor_step(step, clause_by_index[i])
+        elif step.rule == "paramodulate":
+            i, j = step.parents
+            err = _check_paramodulate_step(step, clause_by_index[i], clause_by_index[j])
+        elif step.rule == "reflexivity":
+            (i,) = step.parents
+            err = _check_reflexivity_step(step, clause_by_index[i])
+        elif step.rule == "truth_constants":
+            (i,) = step.parents
+            err = _check_truth_constants_step(step, clause_by_index[i])
+        else:  # "demodulate"
+            i, j = step.parents
+            err = _check_demodulate_step(step, clause_by_index[i], clause_by_index[j])
+
+        if err is not None:
+            return ResolutionCheckResult(False, step.index, f"step {step.index}: {err}", refuted)
+
+        clause_by_index[step.index] = step.clause
+        if not step.clause:
+            refuted = True
+
+    return ResolutionCheckResult(True, None, None, refuted)
+
+
+def check_resolution_proof(derivation: "ResolutionDerivation") -> bool:
+    """Return True iff ``derivation`` is a valid resolution derivation (sound).
+
+    A thin bool wrapper over :func:`verify_resolution_proof`; use that for the
+    failing step index and reason, or to read ``refuted``.
+    """
+    return verify_resolution_proof(derivation).ok
+
+
+# ---------------------------------------------------------------------------
+# Rendering
+# ---------------------------------------------------------------------------
+
+def _render_clause(clause: FrozenSet[Node]) -> str:
+    """Render a clause as its literals joined by ``∨``, or ``□`` if empty.
+
+    Literals are sorted by their Unicode rendering for a deterministic,
+    frozenset-iteration-order-independent string.
+    """
+    if not clause:
+        return "□"
+    return " ∨ ".join(lit.to_unicode_str() for lit in sorted(clause, key=_lit_key))
+
+
+def render_resolution_proof(derivation: "ResolutionDerivation") -> str:
+    """Render ``derivation`` as one numbered line per step.
+
+    Each line is ``N. <clause> [rule parents]`` — the number, the clause, and
+    the justification in brackets. (The format is spelled out here rather than
+    in the summary line above because autosummary cuts that line at the first
+    sentence end, and a ``.`` inside an inline literal reads as one.)
+
+    The empty clause renders as ``□``. Parent indices are comma-joined in
+    citation order; a rule with no parents (``"input"``) renders with no
+    trailing citation list, e.g. ``"1. P(a) [input]"``.
+    """
+    lines = []
+    for step in derivation.steps:
+        bracket = step.rule
+        if step.parents:
+            bracket += " " + ",".join(str(p) for p in step.parents)
+        lines.append(f"{step.index}. {_render_clause(step.clause)} [{bracket}]")
+    return "\n".join(lines)