# logicaffeine_proof > Kernel-checked proof search and tactics, certified SAT/CDCL with DRAT/LRAT output, and a number-theory and cryptanalysis library Every public module and item of `logicaffeine_proof`, module by module, each with its one-line summary and its address. Item pages hold the full signature, documentation, trait implementations and a link to the source. - Crate page: [logicaffeine_proof](https://docs.logicaffeine.com/logicaffeine_proof/) - All items on one page: [logicaffeine_proof/all](https://docs.logicaffeine.com/logicaffeine_proof/all) - Source: [src/logicaffeine_proof/lib.rs](https://docs.logicaffeine.com/src/logicaffeine_proof/lib.rs) - Every crate: [llms.txt](https://docs.logicaffeine.com/llms.txt) ## logicaffeine_proof - [mod affine](https://docs.logicaffeine.com/logicaffeine_proof/affine/): The affine group `AGL(n,2)` — the symmetry a permutation break cannot see. - [mod affine_gfp](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/): The affine group `AGL(n,p)` over `GF(p)` — the mod-`p` generalization of the affine break. - [mod aig](https://docs.logicaffeine.com/logicaffeine_proof/aig/): And-inverter graphs: a circuit as two-input AND gates over complemented edges, read and written in the AIGER format (Biere, The AIGER And-Inverter Graph Format, Version 20071012, and its 1.9 extension). - [mod ait](https://docs.logicaffeine.com/logicaffeine_proof/ait/): Algorithmic information theory — certified description-length objects - [mod arith](https://docs.logicaffeine.com/logicaffeine_proof/arith/): Proof-PRODUCING arithmetic oracle (untrusted search, kernel-checked proof). - [mod bmc](https://docs.logicaffeine.com/logicaffeine_proof/bmc/): Bounded model checking, k-induction, and vacuity over `ProofExpr` — pure-Rust, certified, Z3-free, browser-ready. - [mod cardinality](https://docs.logicaffeine.com/logicaffeine_proof/cardinality/): Cardinality constraints over boolean `ProofExpr` atoms — the missing primitive that lets the certified solver answer “at most / at least / exactly `k` of these are true”. Encoded with Sinz’s sequential counter (linear in `n·k`, fresh auxiliary atoms under a caller-chosen prefix), so the result is an ordinary boolean obligation the existing CNF/CDCL/RUP pipeline discharges. This is the building block for SAT-based optimization (`crate::optimize`). - [mod cdcl](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/): A conflict-driven clause-learning (CDCL) SAT core — the modern competition-grade engine, built to the lineage that made SAT practical: two-watched-literal unit propagation (Moskewicz et al., Chaff, 2001), first-UIP conflict analysis with learned clauses and non-chronological backtracking (Marques-Silva & Sakallah, GRASP, 1996), VSIDS-style activity decisions, and Luby restarts (Luby et al., 1993). The clean reference implementation it follows is Eén & Sörensson’s MiniSat (2003). - [mod certifier](https://docs.logicaffeine.com/logicaffeine_proof/certifier/): The Certifier: Converts DerivationTrees to Kernel Terms. - [mod cnf](https://docs.logicaffeine.com/logicaffeine_proof/cnf/): Tseitin clausification: a grounded, quantifier-free `ProofExpr` → CNF over the CDCL core’s `Lit`s (Tseitin, 1968 — the standard linear-size equisatisfiable transform that introduces one auxiliary variable per compound subformula). This is the bridge from the logic-grid encoding (closures, at-most-one, of-pair, clue clauses) to the `crate::cdcl` SAT engine, giving the Untrusted trust tier: solve `premises ∧ ¬goal`; UNSAT ⇒ the goal is entailed. The same CNF feeds the RUP checker (the fast trust tier) and is the input an AllDifferent GAC propagator filters. - [mod coalgebra](https://docs.logicaffeine.com/logicaffeine_proof/coalgebra/): The coalgebraic / `Poly` view, made into checked code rather than narration. - [mod complexity](https://docs.logicaffeine.com/logicaffeine_proof/complexity/): Certified complexity bounds — a refutation that carries a checkable proof of its own size. - [mod counterexample](https://docs.logicaffeine.com/logicaffeine_proof/counterexample/): Counterexamples — when a goal is FALSE, exhibit a model instead of failing silently. Lean ships no built-in counterexample finder with its automation; this closes that gap. - [mod counting_principle](https://docs.logicaffeine.com/logicaffeine_proof/counting_principle/): Fast refuter for the modular counting principle `Count_q(n)`: partition an `n`-element set into blocks of size `q`. Encoded as: one Boolean per `q`-subset (block); a coverage clause per element (the incident blocks, at least one chosen); and a disjointness clause for every pair of overlapping blocks. It is unsatisfiable exactly when `q ∤ n`. - [mod crush](https://docs.logicaffeine.com/logicaffeine_proof/crush/): `crush` — the grind-style closer: E-match quantified equality lemmas into the ground e-graph, then discharge the goal by certified congruence closure. - [mod cubical](https://docs.logicaffeine.com/logicaffeine_proof/cubical/): A general `d`-dimensional cubical-homology engine — one engine, every rung of the ladder. - [mod cycle_ratio](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/): The maximum cycle ratio of a weighted digraph, exact and certified: the bound a loop puts on a clock period. - [mod cyclotomic](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/): Power-of-two cyclotomic ring `R = ℤ[X]/(Xⁿ + 1)`, `n = 2ᵏ` - [mod decide](https://docs.logicaffeine.com/logicaffeine_proof/decide/): `decide` — proof by evaluation for closed decidable goals. - [mod development](https://docs.logicaffeine.com/logicaffeine_proof/development/): A formal-development parser: the body of a `## Theory` block — a sequence of `Axiom` and `Theorem` declarations in formal notation — into the axioms and `LibraryTheorem`s the multi-theorem driver consumes. - [mod dimacs](https://docs.logicaffeine.com/logicaffeine_proof/dimacs/): DIMACS CNF parsing and printing — the SAT-competition interchange format, and the front door for running arbitrary instances through the solver. - [mod discrimination](https://docs.logicaffeine.com/logicaffeine_proof/discrimination/): First-order discrimination tree: the shared pattern index under `simp` rule lookup, `exact?`/`apply?` library search, and `crush`’s E-matching. - [mod eilenberg_maclane](https://docs.logicaffeine.com/logicaffeine_proof/eilenberg_maclane/): The general Eilenberg–MacLane construction `K(A, n)` — one engine, every rung of the tower. - [mod elliptic](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/): Elliptic-curve primitives over ℤ/N — the additive→multiplicative lift - [mod engine](https://docs.logicaffeine.com/logicaffeine_proof/engine/): Backward chaining proof engine. - [mod error](https://docs.logicaffeine.com/logicaffeine_proof/error/): Error types for proof search and unification. - [mod factor](https://docs.logicaffeine.com/logicaffeine_proof/factor/): Structural factoring: the AIT thesis applied to public-key crypto. - [mod families](https://docs.logicaffeine.com/logicaffeine_proof/families/): Parametric generators for symmetry-rich SAT families — the canonical hard cases where symmetry breaking earns its keep. They are programmatic (reproducible, offline, parametric) rather than vendored `.cnf` files, and each is pinned to its known verdict so the solver and the certified pipeline can be tested against ground truth. - [mod formula](https://docs.logicaffeine.com/logicaffeine_proof/formula/): A self-contained parser from formal first-order-logic surface text to `ProofExpr`. - [mod fp2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/): 𝔽_{p²} arithmetic and the supersingular isogeny graph - [mod fraig](https://docs.logicaffeine.com/logicaffeine_proof/fraig/): Combinational equivalence by incremental SAT sweeping, certified by one derivation. - [mod gf2](https://docs.logicaffeine.com/logicaffeine_proof/gf2/): The general linear group GL(n,2) and the invertibility constant — where the reciprocal SAT-threshold sum comes home. - [mod grid_solver](https://docs.logicaffeine.com/logicaffeine_proof/grid_solver/): A fast, certified finite-domain (logic-grid) solver. - [mod grounding](https://docs.logicaffeine.com/logicaffeine_proof/grounding/): Finite-domain grounding. - [mod groupoid](https://docs.logicaffeine.com/logicaffeine_proof/groupoid/): The action groupoid — what symmetry breaking means, categorically, as checked code. - [mod hints](https://docs.logicaffeine.com/logicaffeine_proof/hints/): Socratic Hint Engine - Generates pedagogical hints for proof guidance. - [mod hornsat](https://docs.logicaffeine.com/logicaffeine_proof/hornsat/): Horn-SAT in linear time via unit propagation (forward chaining). - [mod hypercube](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/): The Boolean hypercube `{0,1}ⁿ` and its subcube cover — the geometric substrate beneath SAT, and the executable form of the Lean formalization’s `HypercubeSAT`. - [mod hyperelliptic](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/): Genus-2 curves and the Richelot (2,2)-isogeny — the abelian-surface mechanism - [mod inprocess](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/): Certified inprocessing: clause-database simplifications that emit a machine-checkable proof. - [mod interval_replay](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/): Independent range-safety checker for analog netlist claims — the trust core of the analog lane’s `RangeCertificate`, in the same spirit as this crate’s PR/RUP checker: a small, dependency-free replay the certificate producer cannot influence. - [mod interval_sched](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/): Interval scheduling in O(n log n) via a sweep line — the matching/Hall reasoner reaching into resource allocation over time. - [mod isogeny](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/): Certified isogeny torsion-image witnesses — the SIDH/SIKE public-data structure, in the prover - [mod kan_complex](https://docs.logicaffeine.com/logicaffeine_proof/kan_complex/): Actually having an ∞-groupoid — not its invariants, the object itself, with its defining property machine-verified. - [mod lattice](https://docs.logicaffeine.com/logicaffeine_proof/lattice/): LLL lattice reduction — the geometric lens of the compression campaign. - [mod lemma_index](https://docs.logicaffeine.com/logicaffeine_proof/lemma_index/): `exact?` / `apply?` and premise selection: search over a NAMED, certified lemma library. - [mod linalg](https://docs.logicaffeine.com/logicaffeine_proof/linalg/): Exact linear algebra over ℚ — the certified core of the LOGOS numerical stack. - [mod linalg_certify](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/): Kernel-certified linear algebra: turn an exact solve into a KERNEL-CHECKED PROOF TERM. - [mod linarith_solve](https://docs.logicaffeine.com/logicaffeine_proof/linarith_solve/): The decision core for linear integer arithmetic: Fourier-Motzkin elimination that tracks the non-negative combination it eliminates with, so an unsatisfiable system yields its Farkas certificate — the multipliers `λᵢ ≥ 0` on the original constraints such that `Σ λᵢ·constraintᵢ` is a positive constant `≤ 0` (a contradiction). The proof engine reconstructs a kernel proof from those multipliers via `le_mul_nonneg`/`le_add_mono` + the Bool no-confusion discriminator. Pure and self-contained — no kernel, no certificates here. - [mod lll](https://docs.logicaffeine.com/logicaffeine_proof/lll/): Satisfiability from sparsity — the Lovász Local Lemma certificate and its constructive Moser–Tardos witness. The lower bookend to the first-moment bound. - [mod lrat](https://docs.logicaffeine.com/logicaffeine_proof/lrat/): LRAT refutations at scale: hint chains found by watched-literal propagation, trimmed to the clauses a refutation uses, and replayed by a checker that trusts nothing the search did. - [mod lyapunov](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/): Lyapunov-function synthesis — don’t search for the proof, discover the measure that collapses the problem, and let the proof fall out as a corollary. - [mod macaulay](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/): Monomials and the Macaulay matrix — the combinatorial skeleton of the XL algorithm. - [mod matching](https://docs.logicaffeine.com/logicaffeine_proof/matching/): Certified bipartite-matching infeasibility — the polynomial reasoner for pigeonhole-shaped problems that are exponential for resolution (and therefore for any CDCL SAT solver, ours included). - [mod min_cost_flow](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/): Minimum-cost flow, exact and certified: the dual of every scheduling and retiming problem whose constraints are differences of two variables, which is how a register cut of least area at a target clock is found. - [mod modm](https://docs.logicaffeine.com/logicaffeine_proof/modm/): Linear algebra over `ℤ/m` for composite `m`, by the Chinese Remainder Theorem — the multiplicative symmetry break. A system `Σ aᵢ·xᵢ ≡ c (mod m)` over a squarefree modulus `m = p₁·…·p_t` factors, through the ring isomorphism `ℤ/m ≅ GF(p₁) × … × GF(p_t)`, into one independent system over each prime field — each decided by `crate::modp::solve` — and the per-field solutions are recombined by CRT. The factorization of the modulus is the symmetry that splits the problem; the prime fields are the irreducible pieces: - [mod modp](https://docs.logicaffeine.com/logicaffeine_proof/modp/): Linear algebra over `GF(p)` — the mod-`p` generalization of the GF(2) parity cut (`crate::xorsat`). - [mod omega_solve](https://docs.logicaffeine.com/logicaffeine_proof/omega_solve/): `omega` — linear INTEGER arithmetic, the discreteness-aware layer over the rational Farkas core. - [mod optimize](https://docs.logicaffeine.com/logicaffeine_proof/optimize/): Certified SAT-based optimization. We have no native MaxSAT/ILP solver, so we minimise an integer cost the honest way: binary-search the smallest feasible cost bound, where each query is a certified decision (`prove_unsat` → `Sat` witness or RUP-`Refuted`). The result is a certified optimum — a witness at the optimum and a refutation at optimum−1 — not merely a value we happened to find. - [mod ordering](https://docs.logicaffeine.com/logicaffeine_proof/ordering/): The ordering-principle specialist — a polynomial-time recognizer + refuter for GT(n), the linear-ordering contradiction. GT(n) asserts a strict total order (totality + antisymmetry + transitivity) in which every element has a strictly greater one (“no maximum”). That is impossible: a finite strict total order always has a maximum. So a complete GT(n) core is unsatisfiable, and any formula containing it (a superset of an UNSAT core) is UNSAT. - [mod parity_cardinality](https://docs.logicaffeine.com/logicaffeine_proof/parity_cardinality/): Fast refuter for the coupled exactly-one + parity family. An exactly-one group (an at-least-one clause plus the full at-most-one clique over its variables) forces EXACTLY one of its selectors true, so their XOR is `1` (odd). If the formula’s parity substructure forces that same XOR to `0` (even), the two are inconsistent and the formula is UNSAT — the mixed obstruction neither theory sees alone. - [mod period](https://docs.logicaffeine.com/logicaffeine_proof/period/): The period / order seam — the classical shell of Shor’s algorithm - [mod permgroup](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/): Schreier–Sims: a base and strong generating set (BSGS) for a permutation group — the non-abelian generalization of Gaussian elimination, and the last rung of the algebra ladder (GF(2)→GF(p)→ℤ/m linear; this is the group level). - [mod pigeonhole](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/): Pigeonhole / bipartite-matching detection for the general solver — the cardinality reasoning that lets `prove_unsat` win on pigeonhole-shaped formulas in POLYNOMIAL time. - [mod polycalc](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/): Polynomial Calculus / Nullstellensatz over `GF(2)` — the algebraic proof system that subsumes the linear cuts (parity is its degree-1 fragment) and, at higher degree, refutes strictly more. - [mod postnikov](https://docs.logicaffeine.com/logicaffeine_proof/postnikov/): The Postnikov `k`-invariant — the gluing data of a 2-type, and the obstruction to breaking it into a product. - [mod pr](https://docs.logicaffeine.com/logicaffeine_proof/pr/): The PR (propagation-redundancy) checker — the trust tier for model-removing clause additions, and the keystone that makes certified symmetry breaking possible. - [mod progress_complex](https://docs.logicaffeine.com/logicaffeine_proof/progress_complex/): Genuine higher homotopy, at last — `π₁ ≠ 0` from real concurrency, the hole is the deadlock. - [mod proof](https://docs.logicaffeine.com/logicaffeine_proof/proof/): Shared proof-step vocabulary for the certified checkers. - [mod proof_emit](https://docs.logicaffeine.com/logicaffeine_proof/proof_emit/): Standard proof-trace emission — DRAT, LRAT, and DPR text from our in-memory `ProofStep` stream, so the certified refutations this crate produces are not merely self-checked but replayable by the SAT community’s independent (and in `cake_lpr`’s case formally verified) checkers. - [mod proof_rewrite](https://docs.logicaffeine.com/logicaffeine_proof/proof_rewrite/): The proof-rewrite 2-cells — independent refutation steps commute, and the commutation squares make the space of proof-orderings a contractible `CAT(0)` cube complex. This is the honest higher structure the symmetry tower pointed at, and it is genuine 2-dimensional homotopy: not a faked `π₂`, but the coherence theorem for proofs — every way of reordering independent steps is coherently the same, up to all higher homotopies. - [mod pseudo_boolean](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/): Pseudo-Boolean constraints + cutting planes — a proof system STRICTLY STRONGER than resolution. - [mod rainbow](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/): Rainbow — Jintai Ding & Dieter Schmidt’s multilayer Oil-and-Vinegar signature (ACNS 2005), the multivariate scheme our XL engine is built to attack. This is a faithful reference over GF(2^8): a two-layer central map `F`, invertible affine transforms `S` and `T`, public key `P = S ∘ F ∘ T`, and the Oil-and-Vinegar trapdoor that inverts `F` at signing time. - [mod register_alloc](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/): Certified linear-scan register allocation — the matching/Hall reasoner as a compiler back-end. - [mod relax_replay](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/): Settled-answer replay — the residual certificate for physics-solved linear systems. - [mod revgate](https://docs.logicaffeine.com/logicaffeine_proof/revgate/): Certify reversible logic gates as bijections. - [mod rule_search](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/): `aesop`-style rule-set search: turn `auto`’s fixed cascade into an extensible, best-first search over registered rules. - [mod rup](https://docs.logicaffeine.com/logicaffeine_proof/rup/): The RUP (Reverse Unit Propagation) linear checker — the fast default trust tier. - [mod sat](https://docs.logicaffeine.com/logicaffeine_proof/sat/): Propositional SAT-discharge of a `ProofExpr` obligation — the engine behind in-browser, Z3-free hardware proving. - [mod satcli](https://docs.logicaffeine.com/logicaffeine_proof/satcli/): The SAT command-line driver shared by `logos-sat` and `largo sat`. - [mod sdcl](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/): Satisfaction-Driven Clause Learning (Heule, Kiesl & Seidl) — the engine that reasons at the Extended-Frege level by discovering propagation-redundant clauses, not just learning implied ones. It is symmetry breaking taken to its limit: where certified symmetry breaking needs an automorphism to supply a witness, SDCL finds the witness by solving the positive reduct — a smaller SAT problem — so it works on any structure, symmetric or not. - [mod seq_equiv](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/): Sequential equivalence by unrolling: a pipelined circuit proven equal to its combinational reference at its latency, or two pipelines of different depths proven to compute the same transaction. - [mod simp](https://docs.logicaffeine.com/logicaffeine_proof/simp/): `simp` rule sets: oriented rewrite rules compiled from proved lemmas, indexed for fast lookup, instantiated by matching. - [mod solve](https://docs.logicaffeine.com/logicaffeine_proof/solve/): Structure-detecting solve front-end — the auto-dispatcher that puts our whole arsenal behind a single entry point. - [mod sos](https://docs.logicaffeine.com/logicaffeine_proof/sos/): Sum-of-Squares / Positivstellensatz refutation over ℚ — kept EXACT (no SDP, no floating point) by the LP slice of the cone. True SoS is a semidefinite program over the reals; that would forfeit our certified guarantee. Instead we take the diagonal (fixed-square-basis) Positivstellensatz, which is an exact rational linear program: a CNF is lifted to degree-2 pseudo-Boolean inequalities and the lift is refuted by exact Fourier–Motzkin / Farkas elimination. - [mod steenrod](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/): The Steenrod algebra acting on `H*(BZ/2; Z/2) = Z/2[x]` — the deepest layer of cohomology operations, and a place where homotopy theory turns out to be number theory. - [mod streams](https://docs.logicaffeine.com/logicaffeine_proof/streams/): Stream equivalence over units proven apart: two circuits that take a stream of tokens through a valid-ready handshake and give a stream back, each at its own width and its own pace, decided equal token for token under an arrival pattern. - [mod sweep](https://docs.logicaffeine.com/logicaffeine_proof/sweep/): Combinational equivalence: two circuits’ outputs proven equal, or told apart by an input assignment that replays, every equality carried by a lemma whose LRAT proof a small checker re-validates. - [mod sym_break](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/): Complete lex-leader symmetry breaking, driven by the Schreier–Sims backend. - [mod sym_certify](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/): Certified symmetry breaking — the centerpiece. Given a formula and a set of verified symmetry generators, add lex-leader symmetry-breaking predicates as PR steps (each self-checked, fail-closed), solve the augmented formula, and emit a single composed refutation that an independent checker accepts against the original formula alone. - [mod sym_dynamic](https://docs.logicaffeine.com/logicaffeine_proof/sym_dynamic/): Dynamic symmetry breaking — Symmetric Explanation Learning (SEL), the in-search tier. - [mod symmetry](https://docs.logicaffeine.com/logicaffeine_proof/symmetry/): Symmetry breaking for the general solver — the second pillar (with `crate::pigeonhole` cardinality reasoning) for winning on pigeonhole. - [mod symmetry_detect](https://docs.logicaffeine.com/logicaffeine_proof/symmetry_detect/): General symmetry detection for CNF — the engine behind certified symmetry breaking. - [mod tactic](https://docs.logicaffeine.com/logicaffeine_proof/tactic/): A tactic framework with a first-class goal state — the interactive proof interface (ROOT R5 of the Lean-competitive architecture). - [mod tactic_cert](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/): Certificate producers and independent checkers shared with the kernel rechecker. - [mod tactic_script](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/): A tiny proof-script language over the `crate::tactic` combinators — proofs as TEXT, the way a Lean/Coq proof reads. This is the self-contained seam toward a full English vernacular: it has no dependency on the surface language, so it compiles a script string straight into a composed `Tactic`. - [mod thermal_replay](https://docs.logicaffeine.com/logicaffeine_proof/thermal_replay/): Thermal-map replay — the independent judge of a claimed steady-state temperature map. - [mod trace_determinism](https://docs.logicaffeine.com/logicaffeine_proof/trace_determinism/): The concurrency tie made literal: determinism = contractibility, on a real machine. - [mod two_group](https://docs.logicaffeine.com/logicaffeine_proof/two_group/): The 2-group frontier — climbing past `K(G,1)` to genuine 2-types, honestly. - [mod two_type](https://docs.logicaffeine.com/logicaffeine_proof/two_type/): A genuinely 2-truncated ∞-groupoid, had as an object: the minimal `K(A, 2)`. - [mod twosat](https://docs.logicaffeine.com/logicaffeine_proof/twosat/): 2-SAT in linear time via the implication graph + strongly-connected components. - [mod unify](https://docs.logicaffeine.com/logicaffeine_proof/unify/): First-order unification for proof search. - [mod units](https://docs.logicaffeine.com/logicaffeine_proof/units/): Equivalence over units proven apart: two circuits built of units (adders, multipliers, any module already proven equal to its counterpart), each unit cut out of its circuit — its results free inputs, its operands outputs — and the two decided over the units as functions they know nothing of, a unit’s own proof standing for what it computes. - [mod verify](https://docs.logicaffeine.com/logicaffeine_proof/verify/): Unified theorem verification — the single door. - [mod xl](https://docs.logicaffeine.com/logicaffeine_proof/xl/): XL — algebraic cryptanalysis of multivariate quadratic (MQ) systems by linearization. - [mod xor_drat](https://docs.logicaffeine.com/logicaffeine_proof/xor_drat/): The CNF→GF(2) bridge: compile a Gaussian (XOR linear-dependency) refutation into a strict DRAT proof that an external checker (`drat-trim`) accepts. - [mod xor_engine](https://docs.logicaffeine.com/logicaffeine_proof/xor_engine/): DPLL(XOR) — the live GF(2) reasoning engine. - [mod xorsat](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/): XOR-SAT via Gaussian elimination over GF(2) — the parity analog of the pigeonhole/matching supercrush. - [struct DerivationTree](https://docs.logicaffeine.com/logicaffeine_proof/struct.DerivationTree): The “Euclidean Structure” - A recursive tree representing the proof. - [struct InductionArg](https://docs.logicaffeine.com/logicaffeine_proof/struct.InductionArg): One argument of a constructor in an `InductionCase`. - [struct InductionCase](https://docs.logicaffeine.com/logicaffeine_proof/struct.InductionCase): The “Lever” - The specific logical move made at each proof step. - [struct MatchArm](https://docs.logicaffeine.com/logicaffeine_proof/struct.MatchArm): A single arm in a match expression. Example: Succ(k) => Add(k, m) - [struct ProofGoal](https://docs.logicaffeine.com/logicaffeine_proof/struct.ProofGoal): The Goal State for the Backward Chainer. - [enum InferenceRule](https://docs.logicaffeine.com/logicaffeine_proof/enum.InferenceRule) - [enum ProofExpr](https://docs.logicaffeine.com/logicaffeine_proof/enum.ProofExpr): Owned expression representation for proof manipulation. - [enum ProofTerm](https://docs.logicaffeine.com/logicaffeine_proof/enum.ProofTerm): Owned term representation for proof manipulation. ## logicaffeine_proof::affine The affine group `AGL(n,2)` — the symmetry a permutation break cannot see. - [struct Affine](https://docs.logicaffeine.com/logicaffeine_proof/affine/struct.Affine): An affine map of the Boolean cube `GF(2)ⁿ`: `x ↦ A x ⊕ b`. `matrix[i]` is row `i` of `A` as a coefficient bitmask over the low `n` bits; `translation` is `b`. It is a bijection iff `A ∈ GL(n,2)`. - [struct AffineCanonical](https://docs.logicaffeine.com/logicaffeine_proof/affine/struct.AffineCanonical): The result of the canonical affine reduction: an equisatisfiable formula over the free generators (the linearly-determined variables eliminated), plus the map to lift a reduced model back to the full space. This is the affine analogue of breaking a permutation orbit down to one representative — here the RREF canonicalizes the affine structure and the determined coordinates fall away. - [enum AffineCanon](https://docs.logicaffeine.com/logicaffeine_proof/affine/enum.AffineCanon): The outcome of the canonical RREF break. - [enum AffineOutcome](https://docs.logicaffeine.com/logicaffeine_proof/affine/enum.AffineOutcome): The outcome of the affine break. - [fn affine_canonicalize](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.affine_canonicalize): The affine SBP — the canonical RREF break. Recover the formula’s GF(2)-linear substructure and take its reduced row-echelon form (via `gf2::solve_gf2`, whose kernel basis is the affine translation symmetry). The RREF partitions variables into free generators and determined coordinates: every variable the kernel never moves is forced to a constant, and every set the kernel moves in lockstep is an equivalence class collapsing to one representative. Substituting those determined coordinates out yields an equisatisfiable formula over the free generators alone — the affine symmetry quotiented to a canonical representative, exactly as a permutation lex-leader collapses an orbit. An inconsistent core instead `AffineCanon::Refuted`s (certified). Sound: the eliminated relations are GF(2)-entailed by the formula, so `AffineCanonical::lift` turns any reduced model into a full one. - [fn affine_reduce](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.affine_reduce): The affine `GF(2)` break. Recover the formula’s linear substructure and Gauss-eliminate it (`gf2::solve_gf2`): an inconsistent core `AffineOutcome::Refuted`s outright; otherwise the elimination’s `gf2::SolutionSpace` exposes which variables are forced (the kernel never moves them ⇒ a unit) and which are locked together (the kernel moves them in lockstep ⇒ an equivalence), and we return those consequences as new clauses (`AffineOutcome::Forced`) — the linear inferences the permutation breaker structurally cannot make. - [fn affine_refutation_drat](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.affine_refutation_drat): The clausal DRAT certificate for an affine refutation, or `None` if the formula’s linear core is not inconsistent (or `num_vars` exceeds the `u64` mask, or the resolution expansion overruns its budget). Recovers the XOR system, finds the GF(2) linear dependency that sums to `0 = 1` (`crate::xorsat::solve`), and compiles it to RUP resolvent lemmas through the `crate::xor_drat` bridge — the same path `Route::Parity` uses, so it is `drat-trim`-checkable against the original CNF. - [fn affine_subspace_agl_order](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.affine_subspace_agl_order): The affine automorphism group order of a `k`-dimensional affine subspace of `GF(2)ⁿ` — i.e. the number of affine maps `x ↦ Ax ⊕ b` fixing the model set of an XOR-defined family whose solution space has dimension `k`. In closed form, computable at every `n` without enumerating `AGL(n,2)`: `|GL(k,2)| · |GL(n−k,2)| · 2^{k(n−k)} · 2^k` — the block-upper-triangular invertible linear parts (`GL(k)` on the subspace, `GL(n−k)` on the quotient, `2^{k(n−k)}` shears between them) times the `2^k` in-subspace translations. The scalable affine-symmetry detector for the whole class of linear families: `Bₙ` sees a vanishing fraction of it (see the tests). - [fn affine_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.affine_symmetries): The affine symmetry group of a formula, computed exhaustively: every `φ ∈ AGL(n,2)` that maps the model set onto itself (`φ` a bijection, so `φ(models) = models` iff `φ` maps each model to a model). This is the `AGL(n,2)` analogue of `symmetry_detect::find_generators` (which finds only the `Bₙ` part), and it is exact for `n ≤ 4` — the instrument that measures `AGL ⊋ Bₙ`. - [fn agl_order](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.agl_order): `|AGL(n,2)| = 2ⁿ · |GL(n,2)|` — the `2ⁿ` translations times the invertible linear parts. - [fn all_affine_bijections](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.all_affine_bijections): Every affine bijection of `GF(2)ⁿ` (each invertible matrix × each translation). Exhaustive — for ground-truth symmetry computation only — so it is capped at `n ≤ 4` (`|AGL(4,2)| = 322 560`). - [fn models_of](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.models_of): The satisfying assignments of a CNF, each packed into the low `num_vars` bits of a `u64`. Brute force over `2^{num_vars}` — small `n` only (the census / symmetry-measurement regime). - [fn recover_linear_system](https://docs.logicaffeine.com/logicaffeine_proof/affine/fn.recover_linear_system): Recover the `GF(2)`-linear substructure of a CNF: the XOR equations its clauses encode (units, binary equivalences, and complete wrong-parity bundles), as `(coefficient-mask, rhs)` rows over the low `num_vars` bits. `None` when there is no linear structure or `num_vars` exceeds the `u64` mask. ## logicaffeine_proof::affine_gfp The affine group `AGL(n,p)` over `GF(p)` — the mod-`p` generalization of the affine break. - [struct AffineP](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/struct.AffineP): An affine map of `GF(p)ⁿ`: `x ↦ A x + b`. `matrix[i][j]` is `A`’s entry, `translation` is `b`; both reduced mod `p`. A bijection iff `A ∈ GL(n,p)`. - [struct AffinePCanonical](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/struct.AffinePCanonical): The reduced one-hot formula over the surviving groups, plus the lift map. - [enum AffinePCanon](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/enum.AffinePCanon): The outcome of the `GF(p)` canonical elimination. - [enum AffinePForced](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/enum.AffinePForced): The outcome of the `GF(p)` SAT-side break. - [fn affine_m_canonicalize](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.affine_m_canonicalize): The composite-ring canonical elimination. The `ℤ/m` analogue of `affine_p_canonicalize` and the eliminate twin of `prime_power_forced`: over a non-prime modulus, recover the mod-`m` system, take its `composite_break_structure`, and physically eliminate the determined one-hot structure rather than merely injecting it. A forced group (`x_g` pinned to a single value) becomes constants; a partially forced group (`x_g` confined to a coset `v ≡ res (mod modu)`, `1 < modu < m`) keeps only its on-coset bits, the rest pinned false; a linked group’s bits alias its representative’s, value-permuted (`b(g,v) = b(rep, σ(v))`, `σ(v) = (v−d)·c⁻¹ mod m`). The result is equisatisfiable over the surviving bits, with `AffinePCanonical::lift` to recover the rest. An inconsistent component `AffinePCanon::Refuted`s; a prime modulus is left to `affine_p_canonicalize`. - [fn affine_m_forced](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.affine_m_forced): The composite `ℤ/m` SAT-side break (squarefree `m`), the full mod-`m` analogue of `affine_p_forced` via CRT (`ℤ/m ≅ ∏ GF(pᵢ)`). Solve the system over each prime field, then for each variable combine the per-prime structure: - [fn affine_p_canonicalize](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.affine_p_canonicalize): The `GF(p)` canonical RREF break (elimination). The one-hot analogue of `crate::affine::affine_canonicalize`: recover the mod-`p` system and solve its space, then physically eliminate the determined one-hot groups rather than merely injecting their consequences. A forced group’s bits become constants; a linked group’s bits alias to its representative’s, value-permuted (`b(g,v) = b(rep, σ(v))` with `σ(v) = (v−d)·c⁻¹`). The result is an equisatisfiable formula over the surviving (free/representative) groups, with `AffinePCanonical::lift` to recover the eliminated bits. An inconsistent core `AffinePCanon::Refuted`s; a composite modulus is left to `affine_m_forced`. - [fn affine_p_forced](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.affine_p_forced): The `GF(p)` SAT-side break. Recover the one-hot mod-`p` system (`crate::modp::recover_from_cnf`) and solve its solution space (`crate::modp::solve_space`), whose kernel is the affine translation symmetry. Two structures fall out, the mod-`p` analogues of `crate::affine::affine_reduce`’s forced units and equivalence classes: - [fn affine_p_refutation_drat](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.affine_p_refutation_drat): The clausal DRAT certificate for a `GF(p)` affine refutation, or `None` if the formula’s mod-`p` core is not inconsistent (or the resolution expansion overruns its budget). Recovers the one-hot `GF(p)` system, finds the `Σ multiplierᵢ·equationᵢ` dependency whose left side cancels while the right does not (`crate::modp::solve`), and compiles it to RUP resolvent lemmas over the Boolean one-hot encoding through the `crate::xor_drat` bridge — `drat-trim`-checkable against the original CNF, the mod-`p` generalization of `crate::affine::affine_refutation_drat`. - [fn affine_p_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.affine_p_symmetries): The affine symmetry group of a `GF(p)` model set, computed exhaustively: every `φ ∈ AGL(n,p)` that maps the model set onto itself. The `AGL(n,p)` analogue of `crate::affine::affine_symmetries` — the instrument that measures `AGL(n,p) ⊋ monomial`. - [fn agl_m_order](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.agl_m_order): `|AGL(n, ℤ/m)|` for squarefree `m`: by CRT (`ℤ/m ≅ ∏ GF(pᵢ)`) the affine group factors as `∏ AGL(n, pᵢ)`, so the order is the product of the prime orders. `None` if `m` is not squarefree. - [fn agl_p_order](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.agl_p_order): `|AGL(n,p)| = pⁿ · |GL(n,p)|`. - [fn all_affine_p_bijections](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.all_affine_p_bijections): Every affine bijection of `GF(p)ⁿ` (each invertible matrix × each translation). Exhaustive — for ground-truth symmetry computation only — bounded so `p^{n²} ≤ 200_000`. - [fn models_p](https://docs.logicaffeine.com/logicaffeine_proof/affine_gfp/fn.models_p): The `GF(p)`-valued solutions of a mod-`p` linear system (`Σ coeffs·x ≡ rhs (mod p)` for each equation), brute force over `pⁿ` — small `n` only. ## logicaffeine_proof::aig And-inverter graphs: a circuit as two-input AND gates over complemented edges, read and written in the AIGER format (Biere, The AIGER And-Inverter Graph Format, Version 20071012, and its 1.9 extension). - [struct Aig](https://docs.logicaffeine.com/logicaffeine_proof/aig/struct.Aig): An and-inverter graph with its inputs, latches, outputs, bad-state properties, invariant constraints and comments. - [struct AigLit](https://docs.logicaffeine.com/logicaffeine_proof/aig/struct.AigLit): A literal of an and-inverter graph: node `n` as `2n`, its complement as `2n + 1`, the AIGER encoding. Node 0 is the constant false. - [struct Latch](https://docs.logicaffeine.com/logicaffeine_proof/aig/struct.Latch) - [struct Port](https://docs.logicaffeine.com/logicaffeine_proof/aig/struct.Port): An input (its node, uncomplemented), output, bad-state property or invariant constraint, with its symbol. - [enum AigerError](https://docs.logicaffeine.com/logicaffeine_proof/aig/enum.AigerError): Why an AIGER file was refused. Lines count from 1. - [enum Init](https://docs.logicaffeine.com/logicaffeine_proof/aig/enum.Init): A latch’s value before the first clock. - [enum Leaf](https://docs.logicaffeine.com/logicaffeine_proof/aig/enum.Leaf): A leaf of a graph being imported into another (`Aig::import`). - [enum Node](https://docs.logicaffeine.com/logicaffeine_proof/aig/enum.Node): What a node is. ## logicaffeine_proof::ait Algorithmic information theory — certified description-length objects - [struct AffineReduction](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.AffineReduction): The affine reduction of a Boolean function: `f(x) = h(reduced) ⊕ ℓ(x)`, where `ℓ` is a linear form and `h` collapses onto the free coordinates. This peels the COMPLEMENT linear structures (`D_a f = 1`) that `reduce_by_invariance` cannot — a residue XOR a linear form is invisible to every other axis but folds here. - [struct AffineSignature](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.AffineSignature): The AGL(n,2)-invariant signature of a Boolean function: its Walsh amplitude distribution and the plateaued/bent classification that distribution induces. - [struct AlgebraicAttack](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.AlgebraicAttack): The certified result of an algebraic-recurrence attack: a low-degree nonlinear feedback register that regenerates a byte string, recovered by `describe::detect_algebraic_recurrence`. This is the OPEN rung — where maximal order complexity can only measure a nonlinear register (its `2^order` truth table), the algebraic attack recovers it as a sparse ANF and thereby compresses it, when the feedback has low degree. The `anf` is a re-checkable witness (replay it with the seed). - [struct AlgebraicImmunityReport](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.AlgebraicImmunityReport): The algebraic-immunity profile of a filter/combining function: the minimum degree of an annihilator (the algebraic attack’s leverage), the maximum possible `⌈n/2⌉`, and whether it sits at that ceiling. - [struct BooleanCensus](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.BooleanCensus): An exhaustive census of the whole Boolean-function space on `n` variables: which structural axis the deep finder wins on, for every one of the `2^{2ⁿ}` functions. - [struct Budget](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.Budget): The prover’s own description budget — the operational Chaitin ceiling. Kolmogorov complexity lower bounds are only certifiable up to what the prover can itself re-check; beyond a resource bound we decline rather than over-claim. Every lower-bound (incompressibility) path is gated by a `Budget` and returns a documented `Refusal` instead of a certificate when a bound is exceeded. (Upper bounds — `DescriptionBound` — are always safe to compute: you can only be pleasantly surprised by a shorter description.) - [struct CombinerLeak](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.CombinerLeak): A certified combiner leak: one candidate LFSR that a keystream measurably correlates with, recovered by `describe::correlation_attack`. The `attack.init_state` is the re-checkable witness. - [struct CompressibilityReport](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.CompressibilityReport): A full compressibility report: the class, the degree (`K̄/n`), and the raw vs described sizes. - [struct CoverageCensus](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.CoverageCensus): A coverage census over a corpus of sequences: how many the lens arsenal covers, how many fall in the uncovered residue, and which lens covered how many. This is the covering problem made countable. - [struct DeepStructureReport](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.DeepStructureReport): The winning axis and description size of the unified deep structure finder. - [struct DescriptionBound](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.DescriptionBound): A computable upper bound `K̄(x)` on the Kolmogorov complexity of an object `x`, over the fixed description language, carrying a re-checkable decode witness. - [struct InvarianceReduction](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.InvarianceReduction): The genuine domain compression from the INVARIANCE subspace `V₀(f) = {a : f(x⊕a) = f(x) ∀x}`: an `(n − dim V₀)`-variable truth table carrying all the information, over the surviving `free_positions`. A rotated junta collapses here even though the coordinate junta lens saw every variable as relevant. - [struct KolmogorovBound](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.KolmogorovBound): A certified Kolmogorov upper bound on a Boolean function: the recursive structure decomposition and its total description size, with a re-checkable decode witness. This is a `K̄` — an UPPER bound only. The kernel-certified Chaitin theorem in this module forbids certifying `K(f) > c` for any function past budget, so a bound that equals the raw `2ⁿ` means “irreducible by this arsenal,” never “incompressible.” - [struct LensCoverage](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.LensCoverage): One lens’s verdict on a sequence: the number of bits it needs to DESCRIBE the sequence (`usize::MAX` if the lens finds no exploitable structure). Lower ⇒ the lens compresses it more. - [struct LensReport](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.LensReport): The result of running the whole lens portfolio against a bit sequence. - [struct LinearDistinguisher](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.LinearDistinguisher): The linear-cryptanalytic profile of a Boolean combining/filter function, from its Walsh spectrum: the best linear approximation (the distinguisher), its nonlinearity, and its correlation-immunity order. - [struct LinearRigidityCert](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.LinearRigidityCert): A re-checkable certificate that `F`’s parity structure admits no linear symmetry shortcut beyond its exposed kernel: the GF(2) coefficient system has rank `rank`, its solution space is exactly `2^solution_count_log2` (spanned by `kernel_basis`), and this is the complete linear structure. - [struct LinearStructureCert](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.LinearStructureCert): The par32-scale linear-structure certificate: the GF(2) rank and kernel dimension of `F`’s parity system, valid for any number of variables (beyond the `u64` cap of `LinearRigidityCert`). It carries no explicit kernel basis — at this scale the witness is recomputation: re-extract the parity system, re-reduce it, and confirm the same rank and kernel dimension. This is the object par32’s “157-dim linearly-rigid kernel” measurement becomes. - [struct LinearStructureReport](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.LinearStructureReport): The linear space `V(f)` of a Boolean function: the directions along which the derivative is constant. - [struct RecursiveReduction](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.RecursiveReduction): The trace of recursively symmetry-breaking an object down to its incompressible core. - [struct SampledCensus](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.SampledCensus): A sampled census of the Boolean-function space on `n` variables, for `n` too large to enumerate. - [struct SboxProfile](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.SboxProfile): The cryptographic structural profile of an S-box. - [struct SboxSpectra](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.SboxSpectra): The affine-invariant spectra of an S-box: the fingerprints for classification up to affine equivalence. - [struct SeparableDecomposition](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.SeparableDecomposition): A direct-sum decomposition `f = constant ⊕ ⊕ᵢ fᵢ(x_{Bᵢ})` over independent variable blocks. - [struct StructuralBound](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.StructuralBound): A certified statement that `F` is described by an orbit-representative set plus automorphism generators — with all three description lengths, the group-entropy, and a self-contained decode witness. `StructuralBound::verify` re-derives `F`, `rep`, and the generators from the three descriptors and confirms the generators are automorphisms and that expanding `rep` by the group they generate reproduces `F` exactly. - [struct StructureCover](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.StructureCover): A cover of the cube by structural class: the ANF degree stratification of a Boolean function. Every function is a XOR of monomials `∏_{i∈S} xᵢ`, and each monomial is a structural class — its degree `|S|` is the order of variable interaction it encodes. Peeling low-degree slices (constant, linear, quadratic, …) covers most of the `2ⁿ` corners with a handful of terms; what remains is the residue: the high-degree core no lower-order slice explains. This is why the peel is more efficient than walking the cube corner by corner — each class-slice accounts for many corners at once, and you reason about the small residue directly instead of labeling all `2ⁿ` of them. - [struct StructureReport](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.StructureReport): The verdict of the hypercube structure finder: the tightest structural class, its description size in bits, and how that compares to the raw `2ⁿ`-bit truth table. - [struct VariableSymmetry](https://docs.logicaffeine.com/logicaffeine_proof/ait/struct.VariableSymmetry): The variable-permutation symmetry of a Boolean function: a certified subgroup `G ≤ Aut(f)` and the input-orbit compression it induces. - [enum CompressibilityClass](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.CompressibilityClass): The compressibility class of an input, read off the winning description-menu generator. - [enum CryptoStrength](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.CryptoStrength): The algorithmic-information verdict on key or ciphertext material (a byte string). - [enum CubeStructure](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.CubeStructure): The compressibility class of a Boolean function on the hypercube, tightest description first. Each variant carries a re-checkable witness (`CubeStructure::reconstruct`) except the residue. - [enum Descriptor](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.Descriptor): The description language. Each variant is a program in a fixed language whose length is the description bound and whose execution (decode) reproduces the object. - [enum LinearShortcut](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.LinearShortcut): The honest verdict on whether `F` admits a linear (GF(2)) symmetry shortcut — the certified, re-checkable “no shortcut of this class” answer the dispatcher and diagnostics can report instead of silently spinning a symmetry search. Class-relative (linear/parity), with the Chaitin ceiling as the documented frame: we certify the linear structure exactly, never claim an absolute bound. - [enum Refusal](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.Refusal): Why a lower-bound certificate was not issued — the documented refusal that makes the Chaitin ceiling operational. A refusal is never a claim that no bound exists; it is an honest “this is beyond what I can re-check within budget.” - [enum RsaAuditVerdict](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.RsaAuditVerdict): The verdict of throwing the ENTIRE arsenal at an RSA public key. - [enum RsaStrength](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.RsaStrength): The structural-security verdict on an RSA modulus. - [enum SboxVerdict](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.SboxVerdict): The structural-security verdict on an S-box — the vectorial analogue of `rsa_full_audit`. It flags only PROVABLE weaknesses (an exact linear relation, a deterministic difference, a quadratic system); a clean profile is the honest ceiling, “no structural weakness of these classes,” never a proof of security (the Chaitin frame in the symmetric world). - [enum StructureTree](https://docs.logicaffeine.com/logicaffeine_proof/ait/enum.StructureTree): A recursive structural decomposition of a Boolean function: the fixed point of the deep finder. - [const GROUP_DECODER_OVERHEAD](https://docs.logicaffeine.com/logicaffeine_proof/ait/constant.GROUP_DECODER_OVERHEAD): The fixed byte cost of the group-expansion decoder (“take `rep`, apply the group generated by `gens`, output the union”). A documented constant so the inequality `K̄(F) ≤ K̄(rep) + K̄(gens) + O(1)` is concrete. - [fn affine_reduce](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.affine_reduce): Peel a linear form off a Boolean function so its complement linear structures become invariances, then reduce. Catches `f = h ⊕ ℓ` where `ℓ` is linear and `h` collapses — the residue-plus-a-linear-form class every other axis misses. Fail-closed: returns `Some` only if the reconstruction re-checks exactly. `None` when there are no complement structures (pure invariance is `reduce_by_invariance`’s job). - [fn affine_signature](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.affine_signature): Compute the affine-equivalence signature of a Boolean function from its Walsh spectrum. `None` if `truth.len()` is not a power of two. - [fn algebraic_attack_on_bytes](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.algebraic_attack_on_bytes): Run the algebraic attack on `data` (its LSB-first bit expansion) at maximal ANF degree `max_degree`, searching register orders `1..=max_order`: return the shortest low-degree nonlinear feedback that regenerates the whole bit stream, with its sparse ANF. `None` when no degree-≤`max_degree` register up to `max_order` fits — the genuine high-degree / incompressible residue (a real cipher’s keystream, the Chaitin ceiling). `max_order` bounds the cost: the solve is `O(rows · M²/64)` with `M = O(Lᵈ)`. - [fn algebraic_filter_attack](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.algebraic_filter_attack): Recover the initial state of a filter generator (a length-`L` LFSR with feedback `taps` filtered by `filter_truth`) via the algebraic attack — the certified break of a target the correlation and Walsh rungs only glimpse statistically. See `describe::algebraic_filter_attack`. Returns the secret initial state (verified by regeneration) or `None`. - [fn algebraic_immunity_of](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.algebraic_immunity_of): The algebraic-immunity profile of a Boolean function given as its `2ⁿ` truth table. Low immunity is a certified structural weakness: a degree-`AI` annihilator turns each keystream bit of a filter generator using `C` into a degree-`AI` equation in the secret state (`algebraic_filter_attack`). Maximal immunity (`AI = ⌈n/2⌉`) is the ceiling — no low-degree relation to exploit. `None` for a malformed table. - [fn assess_key_material](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.assess_key_material): Assess key/ciphertext bytes: `Weak` (with a re-checkable compression witness — the concrete attack) when the engine describes the data in fewer bytes than storing it raw, else `IncompressibleInClass`. - [fn attack_shrinking_generator](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.attack_shrinking_generator): Break a shrinking (clock-controlled) generator: recover both register states from the output alone by guessing the clock register and linear-solving the data register. Reaches a generator whose output is a data-dependent decimation — not a fixed function of any register’s own past — that no feedback, correlation, algebraic, or linear rung can touch. See `describe::attack_shrinking_generator`. - [fn boolean_function_census](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.boolean_function_census): Exhaustively classify every Boolean function on `n` variables by the deep finder’s winning axis. `None` for `n = 0` or `n > 4` (beyond `2^{2⁴} = 65536` functions the space is astronomically large). The residue count is the concrete, countable face of the Chaitin ceiling: it is a growing fraction of the space as `n` rises — structured functions are `2^{poly}`, the space is `2^{2ⁿ}`. - [fn boomerang_uniformity](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.boomerang_uniformity): The boomerang uniformity of an S-box permutation — the third cryptanalytic pillar after differential and linear. `BCT[a][b] = #{x : S⁻¹(S(x)⊕b) ⊕ S⁻¹(S(x⊕a)⊕b) = a}`; the uniformity is the maximum over `a≠0, b≠0` and measures resistance to the boomerang attack (lower is stronger; `2` is optimal, attained exactly by APN permutations). `None` if `sbox` is not a permutation. - [fn census](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.census): Census a corpus of bit sequences through the `lens_report` portfolio: tally what each lens covers and what lands in the uncovered residue. - [fn certified_incompressible_function_exists](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.certified_incompressible_function_exists): A kernel-re-checkable counting certificate that an incompressible Boolean function on `n` variables MUST exist. A function is its `2ⁿ`-bit truth table, and there are only `2^{2ⁿ} − 1` programs shorter than `2ⁿ` bits — too few to name all `2^{2ⁿ}` functions — so at least one has no shorter description. This is the certified REASON the census residue is nonempty: `boolean_function_census` measures it, counting guarantees it. Any such function necessarily sits in the residue (no arsenal compresses the truly incompressible). `None` for `n = 0` or `n > 6` (a `2⁷`-bit truth table overflows the exact-`u128` counting range). Re-check with `crate::pigeonhole::check_counting_cert`. - [fn certify_linear_rigidity](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.certify_linear_rigidity): Certify the linear (GF(2)) rigidity of `F` under the standard budget — `None` on any refusal (no parity structure, or over budget). See `certify_linear_rigidity_within` for the documented refusal. - [fn certify_linear_rigidity_within](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.certify_linear_rigidity_within): Certify the linear (GF(2)) rigidity of `F`, failing closed to `budget`: a system that exceeds the budget’s Gaussian cap returns `Refusal::OverBudgetGaussian` — the operational Chaitin ceiling — rather than a certificate we could not re-check. - [fn certify_linear_structure](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.certify_linear_structure): Certify the GF(2) linear structure of `F` at any scale via the incremental engine, or `None` if there is no parity structure to characterize. - [fn check_linear_rigidity](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.check_linear_rigidity): Re-check a `LinearRigidityCert` against `F`, trusting nothing the producer computed: re-extract the parity system, independently recompute its kernel, and confirm the certificate’s basis is a genuine, independent, complete null-space of the recovered rows. - [fn check_linear_structure](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.check_linear_structure): Re-check a `LinearStructureCert` by re-extracting `F`’s parity system, re-reducing it, and confirming the certificate’s rank, kernel dimension, and equation count are exactly reproduced. - [fn classify_bytes](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.classify_bytes): Classify a byte string by its compressibility class and degree. - [fn classify_int_seq](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.classify_int_seq): Classify an integer sequence (numeric data, not bytes) by its compressibility class, measured against the plain varint encoding — so a linear recurrence (Fibonacci-class) is recognized as a closed-form `Generated` program even though it grows past byte range. - [fn classify_text](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.classify_text): Classify a text string by the compressibility class of its UTF-8 bytes. - [fn exhaustive_coverage](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.exhaustive_coverage): Exhaustively census EVERY length-`len` bit sequence (`2^len` of them): what fraction of the WHOLE space does the lens arsenal cover? The answer is a small sliver — most sequences are incompressible, the residue — which is the concrete, countable face of the Chaitin ceiling. The structured families our lenses catch are real and important, but they are a vanishing fraction of the space; you cannot arrange lenses to cover it all (counting forbids it), and you cannot even certify which points are uncovered (Chaitin forbids that). `len ≤ ~18` to stay tractable. - [fn fast_correlation_attack](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.fast_correlation_attack): Fast correlation attack (Meier–Staffelbach): recover a leaking LFSR’s initial state from a noisy keystream by DECODING the register-as-linear-code, in time polynomial in `L` — where the exhaustive correlation attack (`scan_for_combiner_leaks`, Rung E) needs `O(2^L)`. This is what scales the correlation break to the register lengths real ciphers use. See `describe::fast_correlation_attack`. - [fn find_structure](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.find_structure): Walk the hypercube of a Boolean function (its `2ⁿ` truth table) and return the tightest structural class that describes it, with the achieved description size and a re-checkable witness. Every lens is a traversal of the cube along one axis of structure (coordinate edges, Walsh butterfly, weight shells, Möbius butterfly); the finder reports whichever yields the shortest description, or the residue (`CubeStructure::ResistedArsenal`) when none beats storing the table raw. `None` if `truth.len()` is not a power of two. - [fn find_structure_deep](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.find_structure_deep): Run every structural axis and return the globally tightest description of a Boolean function. `None` if `truth.len()` is not a power of two. - [fn gf256_word_complexity](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.gf256_word_complexity): The GF(2⁸) word linear complexity of a byte string — the length of the shortest byte-oriented (GF(256)) LFSR that generates it, via Berlekamp–Massey over the AES field. The word analogue of the bit linear complexity: low relative to `n/2` ⇒ a word-LFSR keystream, a certified weakness. (Runs in `O(n²)` byte-ops — 64× fewer than the bit-level BM on the same data.) - [fn incompressibility_gate](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.incompressibility_gate): The SAT-dispatcher gate: `Some(cert)` iff `F`’s parity structure is fully exposed AND `F` is provably rigid (`|Aut| = 1`), so the symmetry arsenal is provably useless and the solver may go straight to CDCL with an honest “no shortcut of this class” verdict. The exact rigidity check (`symmetry_entropy_bits == 0`) is size-gated — past `GATE_SYMMETRY_MAX_VARS` the gate declines rather than run the superpolynomial automorphism search (there is no cheap sound global-asymmetry test; it is graph-isomorphism-hard). Fail-closed throughout: any doubt returns `None` and the arsenal runs as usual. - [fn incompressibility_ratio](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.incompressibility_ratio): The incompressibility ratio `K̄(x)/n` for an `n`-byte string — the shortest menu description measured against storing the bytes raw (the incompressible size for byte material). ≈ 1.0 ⇒ incompressible (no exploitable structure of this class); well below 1.0 ⇒ compressible (a short, predictable description exists). - [fn incompressible_string_exists](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.incompressible_string_exists): The incompressibility lemma for length `n`, as a re-checkable counting certificate: `2ⁿ` strings (pigeons) against `2ⁿ − 1` shorter programs (holes) ⇒ an incompressible string exists. `None` only when `n` is out of the exact-`u128` range (`1 ≤ n ≤ 127`). Re-check with `crate::pigeonhole::check_counting_cert`. - [fn kolmogorov_bound](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.kolmogorov_bound): Compute a certified Kolmogorov upper bound for a Boolean function via its recursive structure decomposition. `None` if `truth.len()` is not a power of two. - [fn lens_report](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.lens_report): The auto-lens-finder: run every sequence lens in the arsenal against `bits` and report which one compresses it (covers it) and by how much — or that none do, placing it in the incompressible residue. This makes the covering explicit: each structured family is caught by its own lens, and a cryptographically-random sequence falls through all of them (the ceiling). Lenses are ordered cheapest-first so a covered sequence is recognized quickly. - [fn linear_cryptanalysis](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.linear_cryptanalysis): The linear-cryptanalysis profile of a combining/filter function given as its `2ⁿ` truth table: the whole Walsh spectrum distilled into the best linear approximation, its nonlinearity, and its correlation-immunity order. Where `scan_for_combiner_leaks` (Rung E) reads only weight-1 masks, this reads them ALL — surfacing the multi-register approximation (`mask_weight ≥ 2`) that E is blind to, even on a first-order correlation-immune function. `None` for a malformed table. - [fn linear_shortcut_verdict](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.linear_shortcut_verdict): Decide the linear-shortcut verdict for `F` (fail-closed via `certify_linear_structure`). - [fn linear_structures](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.linear_structures): Detect the linear space `V(f)` of a Boolean function from its autocorrelation. `None` if `truth.len()` is not a power of two. - [fn maximal_order_complexity_of_bytes](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.maximal_order_complexity_of_bytes): The maximal order complexity of a byte string (its LSB-first bit expansion) — the length of the shortest feedback register, LINEAR OR NONLINEAR, generating it. The TOP of the FSR hierarchy: it catches nonlinear generators (NFSRs, algebraic combiners) that fool every linear-complexity measure. Low relative to the bit count ⇒ a short-register generator. This is the last cheap rung — a general nonlinear feedback function is a full truth table (as large as the data), so a low MOC is a certified STRUCTURAL weakness (a short register exists) even though recovering its sparse form is the (hard) algebraic attack. For a real cipher MOC `≈ n/2`: the incompressible residue, the Chaitin ceiling. - [fn recursive_reduce](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.recursive_reduce): Recursively symmetry-break an object until nothing reduces it further. Each level applies the compression lens (the MDL description menu) and recurses on the DESCRIPTION — each compression is a symmetry break, and its output becomes the next object. The recursion terminates at the FIXED POINT: the point where no lens shrinks it, the incompressible core. - [fn reduce_by_invariance](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.reduce_by_invariance): Peel the invariance subspace off a Boolean function: quotient out every direction `a` with `f(x⊕a) = f(x)` and return the smaller function on the surviving coordinates, together with the invariance basis that certifies it. `None` when the invariance subspace is trivial (nothing to reduce). - [fn rsa_full_audit](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.rsa_full_audit): Throw the entire arsenal at an RSA public key `(N, e)`: the structural factoring suite (small factor / close primes / smooth `p−1` / Pollard rho), Wiener’s small-exponent attack, and the compressibility classifier on the modulus bytes. This is the pre-release safety gate — if any of our own mathematics broke RSA, this is where it would surface. `ResistsFullArsenal` is the honest ceiling, not a security proof: we certify weakness whenever structure exists and can never certify its absence. - [fn rsa_structural_audit](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.rsa_structural_audit): Audit an RSA modulus with the full structural factoring arsenal (see `crate::factor`): return a certified factorization if any structural weakness exists, else the soundness verdict — the number-theoretic incompressible residue. Uses the default triage budget. - [fn sampled_boolean_census](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.sampled_boolean_census): Estimate the coverage map at `n` variables (where `2^{2ⁿ}` is unenumerable) from a uniform random sample of `samples` functions, classified by the deep finder’s winning axis. `None` for `n = 0` or `n > 12`. The residue fraction climbs toward `1` as `n` grows — the asymptotic form of the exhaustive census, and the whole thesis: structured functions vanish and almost every function is incompressible. - [fn sbox_full_audit](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.sbox_full_audit): Audit an S-box with the full structural arsenal — differential, linear, algebraic, and boomerang — and return the first provable weakness, else the honest ceiling with the measured profile. `None` if the table length is not a power of two. Threshold-free: it never fabricates a “weak” verdict from an arbitrary cutoff, only from a structure that is exact. - [fn sbox_profile](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.sbox_profile): Profile an S-box `S : {0,1}ⁿ → {0,1}ᵐ` given as its output table (`sbox[x] = S(x)`, `out_bits = m`): differential uniformity, linearity, minimum component degree, and the affine/bijective/APN flags. `None` if the table length is not a power of two. - [fn sbox_spectra](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.sbox_spectra): The affine-equivalence fingerprint of an S-box: its differential and linear spectra. Two S-boxes that are affine-equivalent (`S′(x) = B·S(A·x⊕a)⊕c` for invertible `A,B`) share both spectra, so a difference in either certifies inequivalence — the necessary test at the heart of S-box classification. `None` if the table length is not a power of two. - [fn scan_for_combiner_leaks](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.scan_for_combiner_leaks): Scan a byte keystream against a menu of candidate LFSR feedback tap-sets: return every register the keystream correlates with beyond `significance ×` the spurious floor. Each hit is a certified break of a nonlinear combiner generator — a HIDDEN constituent register recovered independently (Siegenthaler divide-and-conquer), collapsing a `2^(Σ Lⱼ)` search to `Σ 2^Lⱼ`. This reaches the combiners the algebraic-recurrence rung structurally cannot (their output is a function of the hidden register outputs, not of the keystream’s own past). Empty ⇒ no first-order correlation with any candidate: correlation-immune, or not this combiner — the ceiling, where higher-order and fast-correlation attacks take over. - [fn separable_decomposition](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.separable_decomposition): Decompose a Boolean function into its independent direct-sum blocks (the connected components of its ANF interaction graph). `None` if `truth.len()` is not a power of two. - [fn structural_bound](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.structural_bound): Build the structural bound for `F` under a set of candidate `generators`. Returns `None` if any generator is not an automorphism, or if `rep` + generators does not reconstruct `F` (so we never issue a certificate we could not re-check). - [fn structure_cover](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.structure_cover): Peel the cube apart by structural class and examine the residue: return the ANF degree stratification of a Boolean function (its `2ⁿ` truth table). Each degree is a slice of structure; the top nonempty degree is the residue — the interaction order that survives every lower-order peel, and the honest answer to what remains and why. `None` if `truth.len()` is not a power of two. - [fn structure_tree](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.structure_tree): Recursively decompose a Boolean function to the fixed point of the deep finder: peel the tightest axis, then re-run on the smaller function(s) it exposes, until a coordinate leaf or the residue. `None` if `truth.len()` is not a power of two. - [fn two_adic_complexity_of_bytes](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.two_adic_complexity_of_bytes): The 2-adic complexity of a byte string (its LSB-first bit expansion) — the size of the shortest FCSR (feedback-with-carry / add-with-carry) generating it. Low relative to the bit count ⇒ a carry-based keystream that fools every linear-complexity test (Berlekamp–Massey over any field sees high complexity; the carry is nonlinear over GF(2)). The certified weakness the linear tools miss. - [fn variable_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/ait/fn.variable_symmetry): Find the variable-permutation symmetry group of a Boolean function: test every transposition and the cyclic shift, certify the subgroup they generate with Schreier–Sims, and compress by input-orbits. `None` if `truth.len()` is not a power of two. ## logicaffeine_proof::arith Proof-PRODUCING arithmetic oracle (untrusted search, kernel-checked proof). - [fn prove_int_eq](https://docs.logicaffeine.com/logicaffeine_proof/arith/fn.prove_int_eq): Prove an `Int` equality `Eq Int lhs rhs`, or return `None`. ## logicaffeine_proof::bmc Bounded model checking, k-induction, and vacuity over `ProofExpr` — pure-Rust, certified, Z3-free, browser-ready. - [enum BmcOutcome](https://docs.logicaffeine.com/logicaffeine_proof/bmc/enum.BmcOutcome): The verdict of bounded model checking. - [enum InductionOutcome](https://docs.logicaffeine.com/logicaffeine_proof/bmc/enum.InductionOutcome): The verdict of k-induction. - [enum VacuityOutcome](https://docs.logicaffeine.com/logicaffeine_proof/bmc/enum.VacuityOutcome): The verdict of a vacuity check. - [fn check_vacuity](https://docs.logicaffeine.com/logicaffeine_proof/bmc/fn.check_vacuity): Vacuity: can `antecedent` ever be satisfied? An unsatisfiable antecedent means the property is never actually exercised (a vacuous pass / dead trigger). - [fn find_counterexample](https://docs.logicaffeine.com/logicaffeine_proof/bmc/fn.find_counterexample): Bounded model checking: search for a reachable state violating `property` within `max_k` transitions, returning the shallowest counterexample (and its trace) if one exists. - [fn find_counterexample_incremental](https://docs.logicaffeine.com/logicaffeine_proof/bmc/fn.find_counterexample_incremental): Bounded model checking, incrementally: the unrolling is clausified ONCE into a single persistent solver, and each depth’s violation `¬property(k)` is checked by `crate::cdcl::Solver::solve_under_assumptions`. Every clause learned while ruling out a shallow depth is reused at the next — the IPASIR amortisation that makes deep BMC fast. - [fn find_counterexample_symmetric](https://docs.logicaffeine.com/logicaffeine_proof/bmc/fn.find_counterexample_symmetric): Bounded model checking with temporal symmetry breaking. Interchangeable signals (`temporal_symmetry_pairs`) give a system automorphism that holds at every frame, so a swap lifted uniformly through the unrolling permutes counterexample trajectories. We order each pair at the initial frame (`a@0 ≤ b@0`, i.e. `¬a@0 ∨ b@0`): a sound partial lex-leader that keeps at least one trajectory per symmetry orbit. Hence a counterexample exists under the ordering iff one exists at all, and the shallowest violating depth is unchanged — the verdict matches `find_counterexample`, with the symmetric search space pruned. - [fn prove_invariant](https://docs.logicaffeine.com/logicaffeine_proof/bmc/fn.prove_invariant): k-induction: prove `property` is an invariant of the transition system. - [fn temporal_symmetry_pairs](https://docs.logicaffeine.com/logicaffeine_proof/bmc/fn.temporal_symmetry_pairs): The temporal symmetries of a transition system: pairs of base signals interchangeable across all time — a swap that preserves the initial constraint, the transition relation (checked on the generic frame `trans(0)`, hence on every frame by uniformity), and the property. Each surviving pair is a genuine system automorphism when lifted uniformly through the unrolling. ## logicaffeine_proof::cardinality Cardinality constraints over boolean `ProofExpr` atoms — the missing primitive that lets the certified solver answer “at most / at least / exactly `k` of these are true”. Encoded with Sinz’s sequential counter (linear in `n·k`, fresh auxiliary atoms under a caller-chosen prefix), so the result is an ordinary boolean obligation the existing CNF/CDCL/RUP pipeline discharges. This is the building block for SAT-based optimization (`crate::optimize`). - [fn at_least](https://docs.logicaffeine.com/logicaffeine_proof/cardinality/fn.at_least): “At least `k` of `vars` are true” — i.e. at most `n−k` are false. - [fn at_most](https://docs.logicaffeine.com/logicaffeine_proof/cardinality/fn.at_most): “At most `k` of `vars` are true.” Auxiliary atoms are named `{aux}_{i}_{j}`, so distinct constraints in one formula must use distinct `aux` prefixes. - [fn exactly](https://docs.logicaffeine.com/logicaffeine_proof/cardinality/fn.exactly): “Exactly `k` of `vars` are true.” ## logicaffeine_proof::cdcl A conflict-driven clause-learning (CDCL) SAT core — the modern competition-grade engine, built to the lineage that made SAT practical: two-watched-literal unit propagation (Moskewicz et al., Chaff, 2001), first-UIP conflict analysis with learned clauses and non-chronological backtracking (Marques-Silva & Sakallah, GRASP, 1996), VSIDS-style activity decisions, and Luby restarts (Luby et al., 1993). The clean reference implementation it follows is Eén & Sörensson’s MiniSat (2003). - [struct LearnedClause](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/struct.LearnedClause): A learned clause logged for proof reconstruction. Each is a resolvent derivable from the formula by reverse unit propagation — the unit of a DRAT/LRAT proof. With proof tracing on (`Solver::set_lrat`) it carries its LRAT step: its id and the ids of the clauses that, in order, each become unit under its negation until the last conflicts. - [struct Lit](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/struct.Lit): A literal: a variable plus a sign, packed as `var << 1 | negated`. Packing keeps the watch lists and the trail cache-dense, the way every fast solver stores them. - [struct Solver](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/struct.Solver): The CDCL solver. - [enum BudgetedResult](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/enum.BudgetedResult): The outcome of a conflict-budgeted solve: a verdict, or budget exhaustion (with the learned clauses left available for symmetric amplification). - [enum RestartMode](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/enum.RestartMode): The restart heuristic. Glucose’s dynamic LBD policy restarts when recent learned-clause quality (literal-block distance) degrades relative to the global average, and blocks a restart when the trail is unusually long — a sign the search is closing in on a model. Luby is the classic universal sequence (Luby et al., 1993). Adaptive alternates the two in geometrically growing phases (the CaDiCaL/Kissat “stabilizing / non-stabilizing” idea): aggressive Glucose restarts to EXPLORE, then calm Luby restarts to let phase-saving EXPLOIT and dig toward a model — capturing the strength of each and avoiding the per-instance losses of either alone. The choice is a pure search-ORDER heuristic: it never changes a verdict. - [enum SolveResult](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/enum.SolveResult): The verdict of `Solver::solve`. - [trait Theory](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/trait.Theory): A theory propagator (the DPLL(T) seam). The SAT core calls `Theory::propagate` at each fixpoint of Boolean propagation; a theory returns a fresh clause to add (an explanation/conflict) or `None` if it has nothing to say. AllDifferent GAC, EUF, and LIA all implement this without the core knowing the theory. - [type Var](https://docs.logicaffeine.com/logicaffeine_proof/cdcl/type.Var): A propositional variable: an index `0..num_vars`. ## logicaffeine_proof::certifier The Certifier: Converts DerivationTrees to Kernel Terms. - [struct CertificationContext](https://docs.logicaffeine.com/logicaffeine_proof/certifier/struct.CertificationContext): Context for certifying derivation trees into kernel terms. - [fn certify](https://docs.logicaffeine.com/logicaffeine_proof/certifier/fn.certify): Certify a derivation tree, producing a kernel term. ## logicaffeine_proof::cnf Tseitin clausification: a grounded, quantifier-free `ProofExpr` → CNF over the CDCL core’s `Lit`s (Tseitin, 1968 — the standard linear-size equisatisfiable transform that introduces one auxiliary variable per compound subformula). This is the bridge from the logic-grid encoding (closures, at-most-one, of-pair, clue clauses) to the `crate::cdcl` SAT engine, giving the Untrusted trust tier: solve `premises ∧ ¬goal`; UNSAT ⇒ the goal is entailed. The same CNF feeds the RUP checker (the fast trust tier) and is the input an AllDifferent GAC propagator filters. - [struct Cnf](https://docs.logicaffeine.com/logicaffeine_proof/cnf/struct.Cnf): A CNF formula under construction: a variable table (atoms canonicalised so `a = b` and `b = a` share a variable) plus the accumulating clause set. `Clone` so a prepared premise CNF can be reused per goal — the of-pair Tseitin work is done once, then each cell only adds its `¬goal` unit (incremental solving, the IPASIR pattern). - [fn cdcl_entails](https://docs.logicaffeine.com/logicaffeine_proof/cnf/fn.cdcl_entails): Does `premises ⊨ goal` (propositionally)? Encodes `premises ∧ ¬goal` to CNF and runs CDCL: UNSAT ⇒ entailed. `None` if the problem is not purely propositional over recognisable atoms (caller falls back). This is the Untrusted tier — the verdict with no emitted proof, for the raw-speed comparison against Z3. ## logicaffeine_proof::coalgebra The coalgebraic / `Poly` view, made into checked code rather than narration. - [struct TransitionSystem](https://docs.logicaffeine.com/logicaffeine_proof/coalgebra/struct.TransitionSystem): A finite transition system: a coalgebra `S → 𝒫(S)` for the finite-powerset polynomial functor. `successors[s]` lists the states reachable from `s` in one step. - [fn canonical_countdown_morphism](https://docs.logicaffeine.com/logicaffeine_proof/coalgebra/fn.canonical_countdown_morphism): The canonical countdown morphism of a well-founded system: the longest forward path from each state (sinks = 0). This is the terminal such morphism — the existence half of the theorem made constructive. Returns `None` if the system is not well-founded (no morphism exists). - [fn is_countdown_morphism](https://docs.logicaffeine.com/logicaffeine_proof/coalgebra/fn.is_countdown_morphism): Is `measure` a coalgebra morphism to the countdown coalgebra? Every transition `s → t` must strictly decrease it (`measure[t] < measure[s]`) — the morphism square commuting with `n ↦ n-1`. Because the countdown is well-founded, a `true` here witnesses that the system is well-founded. - [fn is_well_founded](https://docs.logicaffeine.com/logicaffeine_proof/coalgebra/fn.is_well_founded): Is the system well-founded (acyclic — no infinite forward trajectory)? Equivalent, for a finite system, to “is a DAG”. Computed by Kahn’s algorithm: a full topological order exists iff there is no cycle. ## logicaffeine_proof::complexity Certified complexity bounds — a refutation that carries a checkable proof of its own size. - [struct RankedRefutation](https://docs.logicaffeine.com/logicaffeine_proof/complexity/struct.RankedRefutation): A refutation whose every step carries a rank (a progress/termination measure). - [struct SizeBound](https://docs.logicaffeine.com/logicaffeine_proof/complexity/struct.SizeBound): A certified upper bound on a refutation’s size, read off a valid rank descent. - [fn certify_size_bound](https://docs.logicaffeine.com/logicaffeine_proof/complexity/fn.certify_size_bound): Verify that `ranks` is a valid non-increasing measure and read off the `SizeBound` it certifies. Returns `None` if the measure ever increases (then it is not a termination measure and certifies nothing). The bound `levels · max_width` is a structural consequence of the annotation, so the checker never re-derives the proof — it only counts. ## logicaffeine_proof::counterexample Counterexamples — when a goal is FALSE, exhibit a model instead of failing silently. Lean ships no built-in counterexample finder with its automation; this closes that gap. - [enum Counterexample](https://docs.logicaffeine.com/logicaffeine_proof/counterexample/enum.Counterexample): A refuting model. - [fn find_counterexample](https://docs.logicaffeine.com/logicaffeine_proof/counterexample/fn.find_counterexample): Search for a counterexample to `premises ⊢ goal`: an assignment satisfying every premise while falsifying the goal. `None` when none is found on the covered fragment (which does NOT prove the goal — absence of a witness here is not a proof). ## logicaffeine_proof::counting_principle Fast refuter for the modular counting principle `Count_q(n)`: partition an `n`-element set into blocks of size `q`. Encoded as: one Boolean per `q`-subset (block); a coverage clause per element (the incident blocks, at least one chosen); and a disjointness clause for every pair of overlapping blocks. It is unsatisfiable exactly when `q ∤ n`. - [struct CountingCert](https://docs.logicaffeine.com/logicaffeine_proof/counting_principle/struct.CountingCert): A modular-counting refutation: an `n`-element set cannot split into blocks of size `q` because `q ∤ n` (the remainder is non-zero). Re-checkable in O(1): `n % q == remainder != 0`. - [fn counting_certificate](https://docs.logicaffeine.com/logicaffeine_proof/counting_principle/fn.counting_certificate): Recover a `Count_q(n)` core from `clauses` and refute it by the `q ∤ n` counting argument, or `None` if there is no such core. Conservative / fail-closed — see the module docs. - [fn refute_counting](https://docs.logicaffeine.com/logicaffeine_proof/counting_principle/fn.refute_counting): Refute a `Count_q(n)` core (`q ∤ n`). `true` iff a certificate is recovered. Never a false refutation. ## logicaffeine_proof::crush `crush` — the grind-style closer: E-match quantified equality lemmas into the ground e-graph, then discharge the goal by certified congruence closure. ## logicaffeine_proof::cubical A general `d`-dimensional cubical-homology engine — one engine, every rung of the ladder. - [struct Cube](https://docs.logicaffeine.com/logicaffeine_proof/cubical/struct.Cube): An elementary cube: the minimal corner, and the sorted set of axes it extends along (each by one unit). The dimension is the number of free axes; fixed axes hold the corner’s value. - [struct CubicalComplex](https://docs.logicaffeine.com/logicaffeine_proof/cubical/struct.CubicalComplex): A cubical complex, stored as the cells of each dimension `0..=dim`. ## logicaffeine_proof::cycle_ratio The maximum cycle ratio of a weighted digraph, exact and certified: the bound a loop puts on a clock period. - [struct Edge](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/struct.Edge): An edge of the graph: `delay` of combinational logic and `registers` on it, both counts. - [enum Bound](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/enum.Bound): What bounds the period. - [enum GraphError](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/enum.GraphError): Why a graph has no bound computed. - [const LIMIT](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/constant.LIMIT): The bound on an edge’s delay and register count. - [const NODES](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/constant.NODES): The bound on the node count. - [fn check](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/fn.check): Whether `bound` is the graph’s: a combinational loop is a simple cycle of no register; a ratio’s cycle is a simple cycle with those sums and some register, and its potential satisfies every edge; acyclic means the graph has no cycle. The graph itself must be well formed. - [fn max_cycle_ratio](https://docs.logicaffeine.com/logicaffeine_proof/cycle_ratio/fn.max_cycle_ratio): The bound on the period the graph’s cycles put. ## logicaffeine_proof::cyclotomic Power-of-two cyclotomic ring `R = ℤ[X]/(Xⁿ + 1)`, `n = 2ᵏ` - [struct Cyclo](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/struct.Cyclo): An element of `R = ℤ[X]/(Xⁿ + 1)`: the coefficient vector `[a₀, …, a_{n−1}]` of `Σ aᵢ Xⁱ`, with `n` a power of two. - [struct LogUnitAudit](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/struct.LogUnitAudit): An audit of the log-unit lattice geometry `Λ = Log(units)` that governs CDPR recovery — the decoding scale of the symmetry-quotient. - [fn approximation_scale](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/fn.approximation_scale): The upstream wall, measured. The approximation scale of the log-unit collapse at dimension `n`: the covering radius `μ(Λ)` against the shortest basis log-length — a proxy for the factor by which a log-unit-decoded generator can exceed the true shortest vector. To threaten Module-LWE this factor would have to stay polynomial; instead it grows super-polynomially with `n` (asymptotically `2^{Õ(√n)}`, Cramer–Ducas–Wesolowski 2017). This is the real wall — not the symmetry-collapse rung (which is cheap, as `recovery_margin` shows) but the quality of what the collapse can decode as the field grows. - [fn audit_log_unit](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/fn.audit_log_unit): Measure the log-unit lattice geometry for `R = ℤ[X]/(Xⁿ+1)`. - [fn cyclotomic_units](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/fn.cyclotomic_units): The cyclotomic units `b_j = 1 + X + ⋯ + X^{j−1} = (Xʲ−1)/(X−1)` for `j` an odd residue in `[3, n−1]`. These are `n/2 − 1` independent units — a basis of a finite-index subgroup of the unit group, and the basis of the log-unit lattice used by CDPR. - [fn galois_group](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/fn.galois_group): The `n = φ(2n)` Galois automorphisms of `R = ℤ[X]/(Xⁿ+1)`, as the odd residues mod `2n` that index them. - [fn recover_short_generator](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/fn.recover_short_generator): CDPR short-generator recovery. Given a generator `h` of a principal ideal that has an unusually short generator `g` (so `h = g·u` for a unit `u`), recover a short generator: project `Log(h)` onto the log-unit lattice against the cyclotomic-unit basis to strip the unit, divide it out exactly (via the Galois-conjugate inverse), and pick the exact generator of smallest coefficient-norm over a local search around the rounded lattice point. Returns `g` up to a root of unity `±Xᵐ`. This is the genuine break on schemes that expose a short principal-ideal generator (Soliloquy, Smart–Vercauteren); it does not touch Module-LWE, where the secret is not such a generator. - [fn recovery_margin](https://docs.logicaffeine.com/logicaffeine_proof/cyclotomic/fn.recovery_margin): The CDPR recovery margin of a candidate generator `g`: `‖proj_{span Λ} Log(g)‖ / μ(Λ)`. A generator whose log projects to well within the covering radius (`margin < 1`) is decodable by stripping the unit; `margin ≫ 1` is beyond the decoding region. This measures where the short-generator wall is — and, honestly, it is small even for short (ML-KEM-shaped) secrets, showing the log-unit collapse is not where Module-LWE’s hardness lives: that sits upstream (no principal-ideal-generator to hand the attacker, module rank ≥ 2, and the `2^Õ(√n)` Ideal-SVP approximation gap). ## logicaffeine_proof::decide `decide` — proof by evaluation for closed decidable goals. ## logicaffeine_proof::development A formal-development parser: the body of a `## Theory` block — a sequence of `Axiom` and `Theorem` declarations in formal notation — into the axioms and `LibraryTheorem`s the multi-theorem driver consumes. - [struct Development](https://docs.logicaffeine.com/logicaffeine_proof/development/struct.Development): A parsed formal development: a shared axiom base and the theorems built on it. - [fn parse_development](https://docs.logicaffeine.com/logicaffeine_proof/development/fn.parse_development): Parse a `## Theory` body into a `Development`. - [fn prove_development](https://docs.logicaffeine.com/logicaffeine_proof/development/fn.prove_development): Parse a `## Theory` body and discharge every theorem against the development’s axioms (and cited lemmas), in citation order — each kernel-certified. Results are in source order, paired with the theorem name. ## logicaffeine_proof::dimacs DIMACS CNF parsing and printing — the SAT-competition interchange format, and the front door for running arbitrary instances through the solver. - [struct DimacsCnf](https://docs.logicaffeine.com/logicaffeine_proof/dimacs/struct.DimacsCnf): A parsed CNF formula: `num_vars` variables and clauses over packed `Lit`s. - [enum DimacsError](https://docs.logicaffeine.com/logicaffeine_proof/dimacs/enum.DimacsError): Why a DIMACS input was rejected. Better a typed error than a silently wrong formula. - [fn parse](https://docs.logicaffeine.com/logicaffeine_proof/dimacs/fn.parse): Parse a DIMACS CNF string. See the module docs for the fail-closed contract. - [fn print](https://docs.logicaffeine.com/logicaffeine_proof/dimacs/fn.print): Render a `DimacsCnf` back to DIMACS text. `parse(print(x)) == x`. ## logicaffeine_proof::discrimination First-order discrimination tree: the shared pattern index under `simp` rule lookup, `exact?`/`apply?` library search, and `crush`’s E-matching. - [struct DiscTree](https://docs.logicaffeine.com/logicaffeine_proof/discrimination/struct.DiscTree): A discrimination tree mapping term/expression patterns to payloads. ## logicaffeine_proof::eilenberg_maclane The general Eilenberg–MacLane construction `K(A, n)` — one engine, every rung of the tower. - [fn homology_size](https://docs.logicaffeine.com/logicaffeine_proof/eilenberg_maclane/fn.homology_size): The `k`-th homology `|H_k(K(A,n))|` via the normalized (Moore) chain complex: `N_k = ⋂_{i≥1} ker dᵢ` with differential `d_0`. Computed independently of the horn-filling homotopy extractor, so that their agreement is the genuine Hurewicz statement, not a tautology. - [fn homotopy_group_size](https://docs.logicaffeine.com/logicaffeine_proof/eilenberg_maclane/fn.homotopy_group_size): Extract the homotopy group `π_k` of `K(A, n)` directly from the Kan complex, by horn-filling. This is the homotopy hypothesis realized computationally — given the ∞-groupoid object, read its homotopy back out. Returns `|π_k|`: `|A|` at `k = n`, trivial (`1`) everywhere else. (`K(A, n≥2)` is 1-connected, so `π_0 = π_1 = 1` by construction.) - [fn is_omega_spectrum](https://docs.logicaffeine.com/logicaffeine_proof/eilenberg_maclane/fn.is_omega_spectrum): Whether the Eilenberg–MacLane spaces `{K(A, n)}` form an Ω-spectrum: each is the loop space of the next, so the homotopy is invariant under the simultaneous shift `n ↦ n+1`, `k ↦ k+1` (`π_k(K(A,n)) = π_{k+1}(K(A,n+1))`). That deloopability is what makes the sequence a spectrum. - [fn stable_homotopy](https://docs.logicaffeine.com/logicaffeine_proof/eilenberg_maclane/fn.stable_homotopy): The stable homotopy of the Eilenberg–MacLane spectrum `HA`: `π_k(HA) = colim_n π_{n+k}(K(A,n))`. For `HA` it is concentrated in degree `0` (`|A|` at `k = 0`, trivial elsewhere) — exactly what makes `HA` represent ordinary cohomology `Hⁿ(−; A)`. Read off the stable range (`N = 4`). ## logicaffeine_proof::elliptic Elliptic-curve primitives over ℤ/N — the additive→multiplicative lift - [struct Curve](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/struct.Curve): A short Weierstrass curve `y² = x³ + a·x + b` over the prime field `𝔽_p`. - [struct Isogeny](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/struct.Isogeny): A separable isogeny `φ: E → E'` of odd prime degree `ℓ`, built from a kernel generator by Vélu’s formulas. Stores the codomain and, for each kernel representative `Q` (one per `±` pair), the Vélu quantities `(xQ, vQ = 6xQ²+2a, uQ = 4yQ²)` used to evaluate `φ`. - [struct IsogenyStep](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/struct.IsogenyStep): A single `ℓ`-isogeny step in a chain: the `domain` curve, the order-`ℓ` `kernel` point quotiented at this step, and the resulting `codomain`. - [enum CurveWeakness](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/enum.CurveWeakness): The known STRUCTURAL weaknesses that make an elliptic curve’s ECDLP breakable — the symmetries a sound curve must avoid. - [enum Point](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/enum.Point): An affine point on a curve, or the point at infinity (the group identity). - [fn curve_security](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.curve_security): Audit a curve of known order `#E` over `𝔽_p` for the structural ECDLP weaknesses. `None` means the only attacks that apply are the generic `O(√·)` ones — the honest ceiling, not a proof of security. - [fn derive_isogeny_path](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.derive_isogeny_path): Torsion-image → path derivation. A degree-`ℓᵃ` isogeny is pinned down by a single kernel generator `gen` of order `ℓᵃ` — the datum the SIDH/SIKE torsion images reconstruct (via Kani’s gluing). This unfolds that one generator into the explicit chain of `a` prime-degree `ℓ`-isogenies: at step `i` the kernel is the order-`ℓ` point `[ℓ^{a−1−i}]·genᵢ`, and `gen` is pushed forward through each step so its order descends `ℓᵃ → ℓᵃ⁻¹ → … → 1`. The entire secret path pops out of the one meta-datum — the generator is the rule that emits the per-step rules. Requires `ℓ` an odd prime and `gen` of order exactly `ℓᵃ`. - [fn ecdlp_bsgs](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.ecdlp_bsgs): Solve the elliptic-curve discrete log `Q = k·P` by baby-step/giant-step, given the order `n` of `P`. `O(√n)` group operations — the best generic attack, and exponential in the bit length. This is exactly why a sound (large prime-order) curve resists, and why ECC uses far smaller keys than RSA. `None` if `Q` is not a multiple of `P`. - [fn ecm](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.ecm): ECM stage 3 — the escalating driver. Stages 1 and 2 are the algorithm; this is the orchestration that makes ECM a complete tool (à la GMP-ECM): run the two-stage method at a schedule of increasing bounds `(b1, b2 = 100·b1)` with growing curve counts, so a factor of any size is found at the cheapest level that reaches it — small factors fall almost immediately, larger ones as the bounds climb, without ever paying the big-bound cost up front. `budget` caps the curves per level. `None` if the whole schedule finishes without a factor. - [fn ecm_factor](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.ecm_factor): Lenstra’s ECM, stage 1 only. Try `curves` Suyama curves at smoothness bound `b1`; a nontrivial factor of `n`, or `None`. Cost tracks the smallest factor, not `n`. `None` for `n ≤ 3`. - [fn ecm_two_stage](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.ecm_two_stage): ECM with stage 1 + stage 2. Stage 2 (bound `b2 > b1`) extends each curve’s reach to a group order that is `b1`-smooth apart from one prime `≤ b2` — a large boost per curve for a small extra cost. - [fn kernel_generator](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.kernel_generator): The SIDH kernel generator `P + [s]·Q` from a torsion basis `(P, Q)` and the secret scalar `s`. The secret isogeny is the quotient by `⟨P + [s]Q⟩`; Kani’s gluing is what lets an attacker recover `s` from the published torsion images, after which `derive_isogeny_path` unfolds the whole chain. - [fn ladder](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.ladder): Scalar multiplication `k·(X:Z)` on a Montgomery curve mod `n` by the Montgomery ladder — a uniform sequence of one double and one differential-add per bit, maintaining the invariant `R1 − R0 = P`. - [fn point_of_order](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.point_of_order): A single point of prime order `ell` on the curve (a candidate isogeny-kernel generator), or `None` if there is no rational `ell`-torsion. Requires `p ≡ 3 (mod 4)`. - [fn torsion_basis](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.torsion_basis): A torsion basis of `E[n]` (`n` prime): two independent points of order `n` generating the full `n`-torsion `(ℤ/n)²`, or `None` if the `n`-torsion is not fully rational. Requires `p ≡ 3 (mod 4)`. This is the public torsion basis whose images an SIDH/SIKE key publishes. - [fn weil_pairing](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.weil_pairing): The Weil pairing `e_N(P, Q) ∈ μ_N` for independent `N`-torsion points `P, Q`, via Miller: `e_N(P,Q) = (−1)ᴺ · f_{N,P}(Q) / f_{N,Q}(P)`. Bilinear, alternating, non-degenerate, and (the SIKE- relevant law) isogeny-compatible. `None` if a Miller evaluation degenerates (e.g. dependent points). - [fn xadd](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.xadd): x-only differential addition on a Montgomery curve mod `n`: given `P=(Xp:Zp)`, `Q=(Xq:Zq)` and their known difference `P−Q = (Xd:Zd)`, return `P+Q`. Again inversion-free. - [fn xdbl](https://docs.logicaffeine.com/logicaffeine_proof/elliptic/fn.xdbl): x-only doubling on a Montgomery curve mod `n`, given `a24 = (A+2)/4`. Maps `(X:Z)` to `2·(X:Z)` using only field `+ − ×` (no inversion). ## logicaffeine_proof::engine Backward chaining proof engine. - [struct BackwardChainer](https://docs.logicaffeine.com/logicaffeine_proof/engine/struct.BackwardChainer): The backward chaining proof engine. - [enum PremiseVariables](https://docs.logicaffeine.com/logicaffeine_proof/engine/enum.PremiseVariables): What a FREE VARIABLE in a knowledge-base equation means. ## logicaffeine_proof::error Error types for proof search and unification. - [enum ProofError](https://docs.logicaffeine.com/logicaffeine_proof/error/enum.ProofError): Errors that can occur during proof search. - [type ProofResult](https://docs.logicaffeine.com/logicaffeine_proof/error/type.ProofResult): Result type for proof operations. ## logicaffeine_proof::factor Structural factoring: the AIT thesis applied to public-key crypto. - [struct StructuralBudget](https://docs.logicaffeine.com/logicaffeine_proof/factor/struct.StructuralBudget): The effort budget for `structural_factor`: each structural attack runs to its own bound, then declines. A soundly-generated modulus exhausts every bound and yields no witness. - [struct StructuralWitness](https://docs.logicaffeine.com/logicaffeine_proof/factor/struct.StructuralWitness): A certified structural weakness: the factors and the attack that found them. - [fn batch_gcd](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.batch_gcd): Batch GCD: catches a shared prime reused across moduli — the classic failure of low-entropy key generation. Any pair with `gcd(Nᵢ, Nⱼ) > 1` hands over the common factor for free. - [fn boneh_durfee](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.boneh_durfee): Boneh–Durfee: recover the factorization from a small private exponent `d < N^{0.284}` — beyond Wiener’s `N^{0.25}` — by bivariate Coppersmith. Since `e·d − 1 = k·φ(N)` and `φ(N) = N + 1 − (p+q)`, the polynomial `f(x, y) = x·y + (N+1)·x + 1` has the small root `(x₀, y₀) = (k, −(p+q))` modulo `e`. The lattice of `x`- and `y`-shifts of `f`, LLL-reduced (fast float-Gram-Schmidt), yields short bivariate polynomials sharing that root; a resultant eliminates `x`, its root gives `s = p+q`, and `z² − s·z + N` splits `N`. `m`, `t` size the lattice; `x_bound = N^δ` bounds `k`. Returns `(p, q)` or `None`. - [fn common_modulus_attack](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.common_modulus_attack): Common-modulus attack: recover `m` when the SAME message is sent to the same modulus `N` under two coprime public exponents `e₁, e₂` (a key-reuse mistake). Bézout gives `a·e₁ + b·e₂ = 1`, so `c₁ᵃ · c₂ᵇ = m^{a·e₁ + b·e₂} = m (mod N)` — negative exponents handled by inverting the ciphertext. - [fn coppersmith_factor_high_bits](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.coppersmith_factor_high_bits): Factor `N` from the high bits of one prime (Coppersmith’s method). We know `p = p_high + x₀` with `0 ≤ x₀ < 2^unknown_bits`; the monic linear polynomial `f(x) = x + p_high` has the small root `x₀` modulo the unknown factor `p`. Coppersmith builds a lattice from the `N`-power and `x`-shift multiples of `f` (all vanishing modulo `pᵐ` at `x₀`), LLL-reduces it, and reads a short vector whose small root is an INTEGER root of a real polynomial — recovering `x₀`, hence `p`. This is the LATTICE lens: a factorization from PARTIAL knowledge that no factoring shortcut (Fermat, rho, `p−1`) can provide. - [fn crt](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.crt): Chinese Remainder Theorem: the unique `x` in `[0, ∏mᵢ)` with `x ≡ residuesᵢ (mod moduliᵢ)` for pairwise-coprime `moduli`, or `None` if a modular inverse fails (moduli not coprime). - [fn dixon_factor](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.dixon_factor): Dixon’s method: factor `N` via a congruence of squares found by a GF(2) dependency among smooth relations (see the module note above). Searches `r = ⌈√N⌉, ⌈√N⌉+1, …` for up to `tries` steps to gather relations whose `r² mod N` is smooth over `base`, then combines them. Returns `(p, q)` or `None` (not enough smooth relations found, or only trivial congruences). Reuses our GF(2) symmetry-breaking on RSA’s ring structure. - [fn factor_via_private_exponent](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.factor_via_private_exponent): Factor `N` from the RSA private exponent `d` (Miller’s deterministic reduction). Since `e·d − 1` is a multiple of `λ(N)`, writing it as `t·2ˢ` and raising a base `g` to `t·2ⁱ` walks a chain that ends at `1`; a step where the value squares to `1` while itself being `≠ ±1` is a NONTRIVIAL square root of unity, and `gcd(x − 1, N)` splits `N`. This is the converse of `rsa_private_exponent`: it proves that recovering the private key is computationally equivalent to factoring the modulus — the two are one problem, so RSA breaks exactly when `N` factors. Returns `(p, q)` or `None` (no base worked). - [fn fermat](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.fermat): Fermat’s method: catches primes that sit too close — `N = a² − b²` with `a` just above `√N`, so a few steps expose `(a−b, a+b)`. Structurally, close primes are a compressed key (one prime nearly fixes the other). - [fn franklin_reiter_attack](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.franklin_reiter_attack): Franklin–Reiter related-message attack: recover `m` from ciphertexts of two LINEARLY RELATED messages `m` and `m + r` (known `r`) under the same modulus `N` and a small public exponent `e`. Both `g₁(x) = xᵉ − c₁` and `g₂(x) = (x + r)ᵉ − c₂` have the root `x = m mod N`, so their GCD over `(ℤ/N)[x]` is the linear factor `x − m`, and `m` is read straight off it. The lens: two ciphertexts sharing a hidden root, extracted by polynomial GCD. - [fn gcd](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.gcd): The greatest common divisor of `|a|` and `|b|` (Euclid). - [fn hastad_broadcast_attack](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.hastad_broadcast_attack): Håstad’s broadcast attack: recover the plaintext `m` from `k ≥ e` ciphertexts `cᵢ = mᵉ mod Nᵢ` of the SAME message under a small public exponent `e` and distinct moduli (see the module note above). CRT reconstructs `mᵉ` exactly, and its integer `e`-th root is `m`. Returns the recovered message, or `None` if the CRT fails or the result is not a perfect `e`-th power (the precondition `k ≥ e` did not hold). - [fn integer_nth_root](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.integer_nth_root): The integer `n`-th root `⌊x^{1/n}⌋` (Newton’s method, overestimate seed then monotone descent, exact final adjustment — the `n`-th-root analogue of `isqrt`). - [fn is_probable_prime](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.is_probable_prime): Miller–Rabin primality over `MR_BASES`. - [fn isqrt](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.isqrt): The integer square root `⌊√n⌋` (Newton’s method). The floating-point seed is only ~15 digits precise, so it is first forced to an OVERESTIMATE (`x² ≥ n`, a handful of doublings); from above, the Newton iteration `x ← ⌊(x + ⌊n/x⌋)/2⌋` decreases monotonically and halts exactly at `⌊√n⌋`. - [fn low_exponent_message](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.low_exponent_message): Low-exponent / no-padding attack: if `mᵉ < N` (a small message under a small public exponent with no padding), then `c = mᵉ` over the integers, so the plaintext is just the integer `e`-th root of `c`. - [fn mod_inverse](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.mod_inverse): The modular inverse `a⁻¹ mod m` via the extended Euclidean algorithm, or `None` if `gcd(a, m) ≠ 1`. - [fn modpow](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.modpow): Modular exponentiation `base^exp mod m` with a full `BigInt` exponent (square-and-multiply, the exponent’s bits read off by repeated halving). - [fn next_prime](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.next_prime): The smallest prime `≥ start`. - [fn pollard_p_minus_1](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.pollard_p_minus_1): Pollard’s `p − 1`: catches a prime with a smooth `p − 1`. Raising a base to `B!` collapses to `1` modulo any prime whose `p − 1` is `B`-smooth, and `gcd(a − 1, N)` exposes it — the smoothness is the structure. - [fn pollard_rho](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.pollard_rho): Pollard’s rho (`f(x) = x² + 1`, Floyd cycle detection): the general-purpose structural probe. Expected `O(N^{1/4})`, so it crushes moderate semiprimes but is bounded out on a large sound modulus. - [fn quadratic_sieve](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.quadratic_sieve): The quadratic sieve (see the module note above): factor `N` by log-sieving `Q(x) = (⌈√N⌉+x)² − N` over `[0, m_interval)` against the factor base of primes `≤ b` for which `N` is a quadratic residue, then combining smooth relations through a GF(2) dependency. Returns `(p, q)` or `None`. - [fn rsa_private_exponent](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.rsa_private_exponent): Derive the RSA private exponent `d = e⁻¹ mod φ(N)` from the public exponent and the two primes (`φ = (p−1)(q−1)`), or `None` if `e` is not coprime to `φ`. The “if you can factor, you can break RSA” direction: the factorization hands over the private key. - [fn structural_factor](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.structural_factor): Run the whole structural arsenal against `n` within `budget`, returning the first certified factorization found, or `None` — the number-theoretic incompressible residue (a sound modulus has no structural shortcut, so only the general sub-exponential algorithms, out of scope here, remain). - [fn trial_division](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.trial_division): Trial division up to `limit`: catches a small factor — a modulus that leaked a tiny prime. - [fn verify_factorization](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.verify_factorization): A nontrivial factorization `p·q = n` (`1 < p, q < n`) — the re-checkable witness every attack returns. - [fn wiener](https://docs.logicaffeine.com/logicaffeine_proof/factor/fn.wiener): Wiener’s attack: catches a small private exponent `d` (`d < ⅓ N^{1/4}`). The convergents of the continued fraction of `e/N` include `k/d`; from `d` we recover `φ(N)`, then `p, q` as roots of `x² − (N − φ + 1)x + N`. A small `d` is a compressed private key — and this reuses the very continued-fraction / rational-reconstruction machinery the 2-adic FCSR rung was built on. ## logicaffeine_proof::families Parametric generators for symmetry-rich SAT families — the canonical hard cases where symmetry breaking earns its keep. They are programmatic (reproducible, offline, parametric) rather than vendored `.cnf` files, and each is pinned to its known verdict so the solver and the certified pipeline can be tested against ground truth. - [enum ExpectedVerdict](https://docs.logicaffeine.com/logicaffeine_proof/families/enum.ExpectedVerdict): The known verdict of a generated instance, for test oracles. - [fn clique_coloring](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.clique_coloring): Graph `k`-coloring of the complete graph `K_n` — the canonical color-permutation symmetry family (the color group `S_k` acts, on top of the vertex group `S_n`). It is unsatisfiable exactly when `k < n` (a clique of size `n` needs `n` colors). The variable “vertex `v` takes color `c`” lives at index `v*k + c`. - [fn functional_php](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.functional_php): The functional pigeonhole principle FPHP(n): `php(n)` strengthened so each pigeon sits in at most one hole (the placement is a function, not a relation). Adds the “no pigeon in two holes” clauses on top of PHP; still UNSAT, still `S_n × S_{n−1}`-symmetric, and the standard strengthening used to check that symmetry breaking survives the extra functional clauses. Same layout as `php`. - [fn grid_tseitin](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.grid_tseitin): The Tseitin formula on a `w × n` grid with odd total charge — UNSATISFIABLE, and the sharpest indictment of resolution search there is. A grid has treewidth exactly `w` (a fixed constant, independent of the length `n`), so a POLYNOMIAL-size, bounded-width resolution refutation provably EXISTS. Yet CDCL solvers without Gaussian reasoning blow up on the parity regardless — they cannot find the short proof that is known to exist — while Gaussian elimination over GF(2) decides it in near-linear time. One Boolean per grid edge; per vertex, the XOR of its incident edges equals its charge (vertex 0 charged, the rest not — an odd sum, hence inconsistent). Returns the XOR system (for `crate::xorsat`) and the equisatisfiable CNF. - [fn ksat_threshold_first_moment_upper](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.ksat_threshold_first_moment_upper): The first-moment (counting) upper bound on the random k-SAT satisfiability threshold: `α*(k) = ln 2 / ln(2ᵏ / (2ᵏ − 1))`. Above this clause density the expected number of satisfying assignments `E[X] = 2ⁿ(1 − 2⁻ᵏ)^{αn} = (2·(1 − 2⁻ᵏ)^α)ⁿ` has per-variable base `< 1`, so `E[X] → 0` and the instance is UNSAT with high probability (Markov) — a rigorous upper bound on the true threshold, exact and closed-form (no sampling). The sequence climbs as `2ᵏ ln 2 − (ln 2)/2`, asymptotically doubling per k: `2.41, 5.19, 10.74, 21.83, 44.02, …` for `k = 2, 3, 4, 5, 6, …`. The true thresholds (≈ 1, 4.27, 9.93, 21.1, …) lie below it; the gap → ½ as k → ∞ (the difference between the first-moment bound `2ᵏln2 − ½ln2` and the sharp value `2ᵏln2 − (1+ln2)/2`). - [fn mod_counting](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mod_counting): The modular counting principle `Count_q(n)`: can the `n`-element set `{0,…,n−1}` be exactly partitioned into blocks of size `q`? A Boolean per `q`-subset (hyperedge); clauses force every element to lie in ≥ 1 chosen block and forbid any two overlapping blocks — so the chosen blocks are a perfect `q`-cover (an exact partition). That exists iff `q ∣ n`, hence the formula is UNSAT exactly when `q ∤ n`. This is the canonical modular family — the obstruction is a counting argument mod `q` that resolution cannot make at low width (Ajtai; Beame–Pitassi), the natural target of the GF(q) / mod-`m` rung. `q = 2` is perfect matching on the complete graph `K_n` (UNSAT for odd `n`). The hyperedge count is `C(n, q)`, so keep `n`, `q` small. - [fn mod_counting_edges](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mod_counting_edges): The edge layout of `mod_counting`: variable `e` is the `q`-subset `mod_counting_edges(n, q)[e]` of the point set `{0,…,n−1}` — the map a witness-support predicate needs to read a monomial as a set of blocks. - [fn mod_counting_groups](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mod_counting_groups): The exactly-one groups of `mod_counting`’s linear encoding: for each point, the variables of its covering clause — the incident `q`-subsets, in the same variable order as `mod_counting`. Feed to `polycalc::exactly_one_linear_generators` for the degree-1 point generators plus overlap pairs (the encoding the modular-counting degree lower bounds are stated against). - [fn mod_m_tseitin_expander](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mod_m_tseitin_expander): The composite-modulus sibling of `mod_p_tseitin_expander`: the same total-charge-2 divergence obstruction over `ℤ/m` for a squarefree composite `m` (e.g. `m = 6`), with a mixed-radix one-hot Boolean encoding (`m` values per edge). By CRT `ℤ/m ≅ ∏ GF(pᵢ)`, so the system is inconsistent over `ℤ/m` exactly when it is inconsistent over some prime factor — total charge `2 ≢ 0 (mod m)` for any `m ≥ 3` that does not divide `2` — and `crate::modm::solve` decides it through that factor with a solver-free re-checkable certificate (`crate::modm::is_refutation`). This drives the ring route (`ℤ/m` Gaussian via CRT), not the prime-field route, on a CNF that resolution still walls on. - [fn mod_p_consistent_onehot](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mod_p_consistent_onehot): A satisfiable sibling of `mod_p_tseitin_expander` over the same 3-regular graph and the same one-hot Boolean encoding, but with a charge distribution whose total `≡ 0 (mod p)`. The divergence system `Σ_out x − Σ_in x ≡ charge(v)` is consistent exactly when the charges sum to zero (summing all vertex equations telescopes the left side to `0`), so this instance is SAT — the control for the GF(p) route’s model-returning path. Charge: `+1` at vertex 0, `−1 (= p−1)` at vertex 1, zero elsewhere. - [fn mod_p_tseitin_expander](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mod_p_tseitin_expander): The mod-`p` Tseitin obstruction on a random 3-regular expander — the parity crush carried to every prime. Each edge carries a `GF(p)` flow variable; orient each edge and impose, at every vertex, the signed divergence `Σ_out − Σ_in ≡ charge (mod p)`. Summing all vertices telescopes the edge variables to `0`, so the system is inconsistent exactly when the total charge `≢ 0 (mod p)`. We charge two vertices (total `2`): inconsistent over `GF(p)` for every odd prime `p`, yet consistent over `GF(2)` (`2 ≡ 0`) — a family the parity cut is structurally blind to, decided instantly by Gaussian elimination over the right `GF(p)`, and (on an expander) exponentially hard for resolution. Returns the `GF(p)` system (for `crate::modp`), the equisatisfiable one-hot Boolean CNF (for resolution solvers), and the `GF(p)` verdict. - [fn mutilated_chessboard](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.mutilated_chessboard): The mutilated chessboard: an `n×n` board with two OPPOSITE corners removed, asking for a perfect domino tiling. Every domino covers one black and one white square, but the two removed corners share a colour (for even `n`), so the black/white counts differ by two and no tiling exists — UNSAT, and a textbook resolution-exponential family. The infeasibility is a bipartite-matching (Hall) obstruction, which our covering route certifies in polynomial time. Variables are dominoes (grid edges between adjacent surviving squares); each surviving square must be covered by exactly one. `n` must be even (so the parity argument bites). - [fn onto_php](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.onto_php): The onto (bijective) pigeonhole principle onto-FPHP(n): `functional_php(n)` further forced to be onto — every hole receives at least one pigeon. The placement is now a bijection `n → n−1`, which cannot exist; UNSAT. This is the hardest standard PHP variant for symmetry reasoning (it pins both the pigeon and the hole side), and the maximal clause set over the shared `php` layout. - [fn ordering_principle](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.ordering_principle): The linear ordering principle GT(n): no finite strict total order lacks a maximal element — yet this formula asserts exactly that, so it is UNSAT. `x[i][j]` (index `i*n + j`) reads “i < j”. Antisymmetry + totality + transitivity force a linear order, and the “every element has a greater one” clauses then contradict finiteness. A canonical resolution-hard family — it stresses the CDCL core / cutting-plane reasoning rather than a matching or parity specialist. - [fn parity_exactly_one](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.parity_exactly_one): Coupled exactly-one + parity — a scalable MIXED family that needs BOTH structures at once. The selectors `x₀…x_{n-1}` are constrained to exactly one true (an at-most-one clique + an at-least-one clause — a cardinality covering) AND to even total parity `⊕ xᵢ = 0` (a GF(2) system, encoded by a width-3 prefix-XOR chain with auxiliaries `sᵢ = ⊕_{j≤i} xⱼ` plus the unit `s_{n-1} = 0`). Exactly-one forces an ODD selector count, the parity forces EVEN — UNSAT, yet neither substructure alone is (the parity chain is satisfiable, exactly-one is satisfiable). The canonical shape for the fused parity+cardinality route (`crate::lyapunov::fused_parity_cardinality_decide`); `2n` variables. - [fn parity_unsat](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.parity_unsat): A guaranteed-unsatisfiable random 3-XOR (parity) system — the `k = 3` case of `random_kxor`: at least `m` 3-XOR equations over `n` variables, all consistent with a planted assignment except one flipped row, built up to maximal GF(2) rank so the inconsistency holds for any seed (see `random_kxor` for why the naive single flip does not suffice). Full-rank 3-XOR above the XOR-SAT threshold is exponentially hard for resolution (Ben-Sasson–Wigderson 2001), hence for every CDCL solver — yet linear for Gaussian elimination over GF(2). Returns the XOR equations (for `crate::xorsat`) and the equisatisfiable CNF (for a resolution solver). - [fn pebbling_pyramid](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.pebbling_pyramid): The pebbling contradiction on the pyramid DAG of the given `height` — the canonical resolution space family (Ben-Sasson–Wigderson; Nordström). The pyramid has rows `0..=height` with row `r` holding `r+1` nodes; each node `(r, i)` for `r < height` has the two predecessors `(r+1, i)` and `(r+1, i+1)` below it. One Boolean per node “is pebbled”: every source (bottom row) is asserted pebbled (unit), pebbling propagates up (`pebbled(a) ∧ pebbled(b) → pebbled(parent)`), and the apex `(0,0)` is asserted unpebbled — a contradiction, so UNSAT. Refutation size is linear (unit propagation alone closes it), but refuting it in small space provably is not — the axis pigeonhole and parity do not touch. - [fn php](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.php): The pigeonhole principle PHP(n): `n` pigeons into `n-1` holes — unsatisfiable, and the textbook symmetry / resolution-hard family (any resolution refutation is exponential, while breaking the `S_n × S_{n-1}` symmetry collapses it). The variable for “pigeon `p` sits in hole `h`” lives at index `p*(n-1) + h`, so pigeons index rows and holes index columns. - [fn ramsey](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.ramsey): The Ramsey formula `Ramsey(s, t; n)`: 2-colour the edges of the complete graph `K_n` (one Boolean per edge — true = red, false = blue) avoiding every red `K_s` and every blue `K_t`. For each `s`-clique a clause forbids all its edges being red; for each `t`-clique a clause forbids all blue. Such a colouring exists iff `n < R(s, t)`, so the formula is UNSAT exactly when `n ≥ R(s, t)`. A genuinely different geometry from pigeonhole/parity — clique structure, not covering or counting — and a classic CDCL stress family (`Ramsey(3,3;6)` is the smallest UNSAT case). Panics for `(s, t)` whose Ramsey number is unknown (so the verdict is never guessed); see `ramsey_number`. - [fn ramsey_number](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.ramsey_number): The known two-colour Ramsey numbers `R(s, t)` for the small `(s, t)` we can actually build CNFs for (symmetric: `R(s, t) = R(t, s)`); `None` when the value is still an open problem. `R(s, t)` is the least `n` such that every red/blue colouring of `K_n`’s edges contains a red `K_s` or a blue `K_t`. - [fn random_3sat](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.random_3sat): A random 3-SAT instance: `num_clauses` clauses of three distinct variables with random signs, over `vars` variables, from a seeded SplitMix64 stream (reproducible — no wall-clock). Near the clause/variable ratio 4.26 these are the canonical hard, non-symmetric benchmarks — the general-instance control where raw CDCL quality (not symmetry breaking) decides the race. - [fn random_ksat](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.random_ksat): A random k-SAT instance: `num_clauses` clauses of `k` distinct variables with random signs, over `vars` variables, from a seeded SplitMix64 stream (reproducible — no wall-clock). Generalizes `random_3sat`. The satisfiability threshold climbs with `k` roughly as `α_k ≈ 2ᵏ ln 2` (≈ 4.27 for k=3, ≈ 9.93 for k=4, ≈ 21.1 for k=5). Requires `k ≤ vars`. - [fn random_kxor](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.random_kxor): A guaranteed-unsatisfiable random k-XOR (parity) system over `n` variables: at least `m` equations of `k` distinct variables, all consistent with a planted assignment `p` except one whose right-hand side is flipped. Generalizes `parity_unsat` (the `k = 3` case). - [fn tseitin_expander](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.tseitin_expander): The Tseitin formula on a random 3-regular expander with odd total charge — UNSATISFIABLE, exponentially hard for resolution (so every CDCL solver blows up), yet solved in polynomial time by Gaussian elimination over GF(2). A non-pigeonhole hard family: the hardness is parity / graph expansion, not covering symmetry. One Boolean per edge; per vertex, the XOR of its incident edges equals that vertex’s charge (vertex 0 charged, the rest not — an odd sum, hence inconsistent). Returns the XOR system (for `crate::xorsat`) and the equisatisfiable CNF. - [fn weak_php](https://docs.logicaffeine.com/logicaffeine_proof/families/fn.weak_php): The weak pigeonhole principle `PHP^{holes}_{pigeons}`: `pigeons` pigeons into `holes` holes — unsatisfiable exactly when `pigeons > holes`. Generalizes `php` (which is the tight `holes = pigeons − 1` case) to any hole count, including the weak regime (`holes = 2·pigeons`, `pigeons²`, …) used to probe how far symmetry breaking scales as the holes-to-pigeons ratio grows. Same variable layout as `php` — “pigeon `p` in hole `h`” at index `p*holes + h` — so `weak_php(n, n−1)` is byte-for-byte `php(n)`. ## logicaffeine_proof::formula A self-contained parser from formal first-order-logic surface text to `ProofExpr`. - [struct FormulaError](https://docs.logicaffeine.com/logicaffeine_proof/formula/struct.FormulaError): A failure to parse formal-logic surface text. - [fn parse_formula](https://docs.logicaffeine.com/logicaffeine_proof/formula/fn.parse_formula): Parse formal first-order-logic surface text into a `ProofExpr`. ## logicaffeine_proof::fp2 𝔽_{p²} arithmetic and the supersingular isogeny graph - [struct Curve2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/struct.Curve2): A Weierstrass curve `y² = x³ + ax + b` over `𝔽_{p²}`. - [struct Isogeny2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/struct.Isogeny2): A separable `ell`-isogeny over `𝔽_{p²}` by Vélu’s formulas (the `Curve2` analogue of `elliptic::Isogeny`). - [struct IsogenyStep2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/struct.IsogenyStep2): A single `ℓ`-isogeny step over `𝔽_{p²}`: domain, the order-`ℓ` kernel, and codomain. - [struct SsVertex](https://docs.logicaffeine.com/logicaffeine_proof/fp2/struct.SsVertex): A vertex of the supersingular isogeny graph: a j-invariant and its 2-isogenous neighbours (as a multiset — a double root of `Φ₂` is a double edge). - [enum Point2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/enum.Point2): An affine point over `𝔽_{p²}`, or the identity. - [fn aut_1728](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.aut_1728): The order-4 automorphism `ι:(x,y) ↦ (−x, i·y)` of the `j = 1728` curve `y² = x³ + x` (`i² = −1` lives in `𝔽_{p²}` for `p ≡ 3 mod 4`). `ι² = [−1]`, so `⟨ι⟩ ≅ ℤ/4 = Aut(E₀)`. It permutes the keyspace, and `E₀/⟨K⟩ ≅ E₀/⟨ι(K)⟩` — the symmetry that makes recovering one kernel recover its whole orbit. - [fn derive_isogeny_path2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.derive_isogeny_path2): Unfold one order-`ℓᵃ` kernel generator into the chain of `a` prime-degree `ℓ`-isogenies over `𝔽_{p²}` — the `Curve2` analogue of `crate::elliptic::derive_isogeny_path`. `ℓ` an odd prime. - [fn fp2_add](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_add) - [fn fp2_const](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_const): A rational constant `k` as an element of `𝔽_{p²}`. - [fn fp2_inv](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_inv): `(a+bi)⁻¹ = (a − bi)/(a² + b²)`. `None` only for `0`. - [fn fp2_is_zero](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_is_zero) - [fn fp2_mul](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_mul): `(a+bi)(c+di) = (ac − bd) + (ad + bc)i`. - [fn fp2_neg](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_neg) - [fn fp2_pow](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_pow): `α^k` in `𝔽_{p²}` by square-and-multiply. - [fn fp2_sqrt](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_sqrt): `√α` in `𝔽_{p²}` (`p ≡ 3 mod 4`), or `None` if `α` is not a square. From `β² = α` with `β = x + yi`: `x² − y² = a`, `2xy = b`, whence `x² = (a ± √(a²+b²))/2`; a final `β² = α` check makes it exact. - [fn fp2_sub](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.fp2_sub) - [fn full_order_basis2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.full_order_basis2): A rank-2 basis `(P, Q)` of `E[ℓᵃ] = (ℤ/ℓᵃ)²` — both of order exactly `ℓᵃ`, independent. The full `ℓᵃ`-torsion is `𝔽_{p²}`-rational on a supersingular curve when `ℓᵃ | p+1`. - [fn isogeny_graph_distances](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.isogeny_graph_distances): Backward BFS on the supersingular `ℓ`-isogeny graph from `target`: the minimum `ℓ`-isogeny distance to each reachable `j`-invariant, out to `max_depth`. This is a sound per-digit oracle — a partial curve farther from the target than its remaining step budget cannot lie on the secret path, so its whole subtree is dead. - [fn kernel_generator2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.kernel_generator2): The SIDH kernel generator `P + [s]·Q` over `𝔽_{p²}`. - [fn keyspace_codomain_classes](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.keyspace_codomain_classes): Partition the keyspace by codomain `j`-invariant: secrets whose isogeny lands on the same curve (up to isomorphism). These classes are exactly the `Aut(E₀)`-orbits — so if one secret in a class is invertible (its codomain is the target `E`), every secret in the class maps to a curve `≅ E`. Returns `(j, [secrets])` groups. - [fn point_of_order2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.point_of_order2): A point of prime order `ell` over `𝔽_{p²}` (a candidate isogeny kernel), or `None`. - [fn point_order2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.point_order2): The order of a point over `𝔽_{p²}` (least `k ≥ 1` with `k·pt = O`), searched up to `bound`. - [fn product_weil_pairing](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.product_weil_pairing): The Weil pairing on a product surface `E₁ × E₂`: `e((P₁,P₂),(Q₁,Q₂)) = e_N(P₁,Q₁)·e_N(P₂,Q₂)`. A subgroup on which this vanishes (`= 1`) is isotropic; a maximal isotropic (Lagrangian) subgroup is the kernel of an `(N,N)`-isogeny of abelian surfaces — the gluing at the heart of Kani’s theorem and the Castryck–Decru attack. - [fn push_through2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.push_through2): Push a point through an entire isogeny chain, rebuilding each step’s Vélu map. - [fn recover_secret2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.recover_secret2): Images → generator reconstruction (flat oracle). The secret isogeny `φ: E₀ → E` of degree `ℓᵃ` has kernel `⟨P_A + [s]Q_A⟩`; the published torsion images `φ(P_B), φ(Q_B)` pin `s` down. Enumerate the whole keyspace and return the scalar whose unfolded chain reproduces both images — a genuine images → generator inversion at SIDH scale. `O(ℓᵃ)`; the correctness oracle for the structured recovery below. - [fn recover_secret_pruned2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.recover_secret_pruned2): Oracle-pruned images → generator recovery. Walks the `ℓ`-adic keyspace tree but consults the isogeny graph reachability oracle (backward BFS from the public codomain `target`) at every node, pruning any branch that can no longer reach the target. Returns the secret, its generator, and the number of leaf image-tests performed (the pruned search visits only the target’s `Aut`-orbit). Same answer as `recover_secret2` — soundness guarantees the true path is never pruned. - [fn recover_secret_recursive2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.recover_secret_recursive2): Structured images → generator recovery. Walks the `ℓ`-adic keyspace tree (auto-partitioning by digit) rather than the flat list, returning the recovered `ℓ`-adic digits, the secret `s = Σ dₖ·ℓᵏ`, and its generator. Same answer as `recover_secret2` — but the recursion is the digit-by-digit structure the Castryck–Decru Kani oracle prunes with a per-digit split-test. - [fn supersingular_graph](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.supersingular_graph): Build the supersingular ℓ=2 isogeny graph over `𝔽_{p²}` (requires `p ≡ 3 (mod 4)`). Breadth-first from the supersingular vertex `j = 1728`, following the roots of `Φ₂(j,·)`. Because the graph is connected, this reaches every supersingular j-invariant; its size is the supersingular mass `⌊p/12⌋ + ε` and every vertex has out-degree 3. `None` if `p ≢ 3 (mod 4)`. - [fn torsion_basis2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.torsion_basis2): A torsion basis of `E[n]` over `𝔽_{p²}` (`n` prime) — the full `n`-torsion is `𝔽_{p²}`-rational on a supersingular curve when `n | p+1`. `None` if it is not fully rational. - [fn weil_pairing2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/fn.weil_pairing2): The Weil pairing over `𝔽_{p²}` — the `Curve2` analogue of `elliptic::weil_pairing`, via Miller. - [type Fp2](https://docs.logicaffeine.com/logicaffeine_proof/fp2/type.Fp2): An element `a + b·i` of `𝔽_{p²} = 𝔽_p[i]/(i²+1)`. ## logicaffeine_proof::fraig Combinational equivalence by incremental SAT sweeping, certified by one derivation. - [struct Options](https://docs.logicaffeine.com/logicaffeine_proof/fraig/struct.Options): How `decide` searches. - [struct Progress](https://docs.logicaffeine.com/logicaffeine_proof/fraig/struct.Progress): A report of a long search: `report` is handed the cost so far once every `every` nodes swept, once the sweep is done, and once the output pairs are, before the derivation is taken from the log. - [struct Report](https://docs.logicaffeine.com/logicaffeine_proof/fraig/struct.Report): A decided miter: a verdict per output name, the derivation behind the equalities, and the search’s cost. - [struct Stats](https://docs.logicaffeine.com/logicaffeine_proof/fraig/struct.Stats): What a decision cost. - [fn decide](https://docs.logicaffeine.com/logicaffeine_proof/fraig/fn.decide): Decide `a ≡ b` for every pair of literals of `aig`, latches read as free values: a verdict per pair, the derivation of every equality from `formula`, and the cost. - [fn equivalent](https://docs.logicaffeine.com/logicaffeine_proof/fraig/fn.equivalent): Pair `left` and `right` by output name and decide every pair. - [fn formula](https://docs.logicaffeine.com/logicaffeine_proof/fraig/fn.formula): The miter’s formula: for each And node in order its three Tseitin clauses, and node 0 false. ## logicaffeine_proof::gf2 The general linear group GL(n,2) and the invertibility constant — where the reciprocal SAT-threshold sum comes home. - [struct SolutionSpace](https://docs.logicaffeine.com/logicaffeine_proof/gf2/struct.SolutionSpace): The complete solution space of a GF(2) linear system `A x = b`, in symmetry-broken form: one particular solution `x₀` plus a basis of the kernel. Every solution is `x₀ ⊕ (a GF(2) combination of the kernel basis)`, so the entire affine coset — all `2^{n−rank}` solutions — is generated from this compressed witness. The kernel is the symmetry group of the solution set (the translations that preserve `Ax`), `x₀` is one witness, and the basis are its generators: this is the exact, polynomial, linear analog of `hypercube::model_orbit`. The harder the break (the bigger the kernel), the more solutions; an invertible system has a trivial kernel — no symmetry, a unique witness. - [fn count_invertible_gf2_bruteforce](https://docs.logicaffeine.com/logicaffeine_proof/gf2/fn.count_invertible_gf2_bruteforce): Brute-force count of invertible n×n GF(2) matrices, over all `2^{n²}` of them. Feasible for `n ≤ 4`. - [fn gl_order](https://docs.logicaffeine.com/logicaffeine_proof/gf2/fn.gl_order): `|GL(n,2)|` via the orbit–stabilizer (ordered-basis) factorization `Π_{i=0}^{n-1}(2ⁿ − 2ⁱ)`. Each factor `2ⁿ − 2ⁱ` is the count of vectors outside the i-dimensional span of the basis chosen so far — the symmetry-broken enumeration of the bases on which `GL(n,2)` acts simply transitively. Valid up to `n = 10` before the `u128` product overflows. - [fn invertibility_density](https://docs.logicaffeine.com/logicaffeine_proof/gf2/fn.invertibility_density): The Euler partial product `Π_{j=1}^n (1 − 2⁻ʲ)` — the exact invertibility density `|GL(n,2)| / 2^{n²}`. - [fn is_invertible_gf2](https://docs.logicaffeine.com/logicaffeine_proof/gf2/fn.is_invertible_gf2): Is an n×n GF(2) matrix (each row packed as the low `n` bits of a `u64`) invertible? Gaussian elimination over GF(2): invertible iff it reduces to full rank `n`. - [fn solve_gf2](https://docs.logicaffeine.com/logicaffeine_proof/gf2/fn.solve_gf2): Solve a GF(2) system `A x = b` (each row a coefficient bit-vector in the low `n` bits, `rhs` the right-hand sides) for its entire solution space via Gaussian elimination to reduced row echelon form. Returns the symmetry-broken `SolutionSpace` (particular solution + kernel basis), or `None` iff the system is inconsistent. Generalizes `crate::xorsat::solve`, which returns just one witness. ## logicaffeine_proof::grid_solver A fast, certified finite-domain (logic-grid) solver. - [fn grid_prove](https://docs.logicaffeine.com/logicaffeine_proof/grid_solver/fn.grid_prove): Solve a single grid cell by propagation and emit its certified derivation. The premises must be ground (call `grounding::ground_problem` first). Returns `None` when the cell is not forced by propagation alone (it needs search — Phase C) or the premises do not classify as a grid. ## logicaffeine_proof::grounding Finite-domain grounding. - [fn at_most_one_lemmas](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.at_most_one_lemmas): “Exactly one φ” entails “at most one φ” — for every premise of the form `∃x(φ(x) ∧ ∀y(φ(y) → y = x))` (what `Cardinal(1)` produces), emit the PAIRWISE uniqueness `∀x∀y((φ(x) ∧ φ(y)) → x = y)`. - [fn column_closure_lemmas](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.column_closure_lemmas): HIDDEN SINGLE — the COLUMN closure, dual of the row closure. Each `Exactly one φ` premise (`∃x(φ(x) ∧ ∀y(φ(y) → y = x))`, e.g. “exactly one trip is in Florida”) entails that AT LEAST ONE row holds the value: `⋁_{r∈dom} value(r)`. The row closure says a row takes SOME value; this says a value is taken by SOME row. Together with functionality (a row takes at most one value), it is the deduction a human calls a “hidden single” — once every other row is excluded from a value, the remaining row MUST hold it, and the EXISTING literal unit-propagation forces it. - [fn definite_property_implications](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.definite_property_implications): “The unique D-trip has property P.” Each single-`∃` definite-description clue `∃x(D(x) ∧ … ∧ P(x))` whose anchor `D` is a SINGLETON grid value (it carries an `Exactly one …` premise, so the description denotes a unique row) entails the propagatable rule `∀t(D(t) → P(t))`; when `P` is ALSO a singleton value the biconditional `∀t(P(t) → D(t))` too — e.g. “the Florida trip is the hunting trip” ⇒ `In(t,Florida) ↔ Hunt(t)`. Sound: a singleton value names a unique row, so any row holding it IS that row and therefore carries the clue’s property. This replaces the existential (whose sort-aware grounding still explodes to a row-disjunction) with row-indexed implications the incremental solver propagates. - [fn discharge_unary_facts](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.discharge_unary_facts): Discharge known ground UNARY facts (`Trip(Alpha)`, …) throughout the premises: each is true, so replace it with `True` and simplify `True ∧ X ↦ X`, `True → X ↦ X`. Unit propagation on the sort facts — it strips the sort guards out of every grounded clause (`(Trip(x) ∧ In(x,FL)) ∧ … ↦ In(x,FL) ∧ …`, and a closure `Trip(t) → D ↦ D` becomes a bare disjunction fact), leaving the pure value-literal clauses propagation runs on in ONE step. Sound: a true conjunct/antecedent carries no information. - [fn domain_constants](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.domain_constants): The DOMAIN of a problem: every constant named across `exprs`. For a domain-closed finite problem this is the universe of individuals to ground over. - [fn functionality_lemmas](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.functionality_lemmas): FUNCTIONALITY — the missing half of a grid’s bijection. Each closure `∀x(guard(x) → L1 ∨ L2 ∨ … ∨ Ln)` says a row takes AT LEAST one value; this emits the AT MOST ONE companion `∀x(Li → ¬Lj)` for every ordered pair of distinct disjuncts. A trip is in exactly one state (one year, …), so a value assigned to a row EXCLUDES the row’s other values — the propagation that, together with value-uniqueness, determines the whole grid. Sound: for a square grid functionality is entailed by closure + value-uniqueness + counting, and it is in any case the inherent single-valuedness of the attribute. Each `Li` must be an atom mentioning the bound variable (a genuine closure), so unrelated `∀→∨` premises are skipped. - [fn ground](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.ground): Ground every quantifier in `e` over `domain` (Herbrand expansion): a universal becomes the conjunction of its instances, an existential the disjunction. The returned expression is quantifier-free when `domain` covers the universe. - [fn ground_problem](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.ground_problem): Ground a whole problem — premises AND goal — over the domain of constants they name. The returned premises and goal are quantifier-free (so the kernel proves them, certified, and Z3 decides them instantly). - [fn ground_problem_sorted](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.ground_problem_sorted): `ground_problem` but sort-aware (each quantifier grounds over its guard sort). The default entry point for finite-domain solving. - [fn ground_sorted](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.ground_sorted): SORT-AWARE grounding: a guarded quantifier expands only over its sort’s domain (`∀x(Trip(x)→…)` over the trips), falling back to `fallback` (the full universe) for an unsorted quantifier. Sound for a domain-closed problem and dramatically smaller than universe-grounding — the optimization the larger puzzles need. - [fn simplify_trivial_identities](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.simplify_trivial_identities): Fold away trivial (reflexive) identities and the boolean constants they create: a grounded `∃x∃y` of-pair has a DIAGONAL instance (`x = y = c`) carrying `¬(c = c)`, which is `False`, so that disjunct must drop. Without it the solver would face an unsatisfiable disjunct it cannot refute (the kernel has no reflexivity rule to prove `c = c`). `Identity(c,c) ↦ True`, `¬True ↦ False`, then `∧`/`∨`/`→` constant-fold. - [fn sort_domains](https://docs.logicaffeine.com/logicaffeine_proof/grounding/fn.sort_domains): Per-sort domains: for each UNARY predicate used as a sort guard (`Trip`, `Year`, …), the constants asserted to have it. Built from the ground facts the declarations produce (`Trip(Alpha)`, `Trip(Beta)`, …). This is what lets grounding expand `∀x(Trip(x)→…)` over the 4 trips, not the whole universe. ## logicaffeine_proof::groupoid The action groupoid — what symmetry breaking means, categorically, as checked code. - [struct ActionGroupoid](https://docs.logicaffeine.com/logicaffeine_proof/groupoid/struct.ActionGroupoid): The action groupoid `X ⫽ G`: assignments over `nv` variables acted on by the group generated by `gens` (literal permutations). Small `nv` only — it enumerates all `2^nv` objects, which is the point: it makes the orbit collapse visible and checkable. ## logicaffeine_proof::hints Socratic Hint Engine - Generates pedagogical hints for proof guidance. - [struct SocraticHint](https://docs.logicaffeine.com/logicaffeine_proof/hints/struct.SocraticHint): A Socratic hint - a leading question to guide the user - [enum SuggestedTactic](https://docs.logicaffeine.com/logicaffeine_proof/hints/enum.SuggestedTactic): Tactics that the user might try - [fn suggest_hint](https://docs.logicaffeine.com/logicaffeine_proof/hints/fn.suggest_hint): Generate a Socratic hint based on the goal and available knowledge ## logicaffeine_proof::hornsat Horn-SAT in linear time via unit propagation (forward chaining). - [struct HornClause](https://docs.logicaffeine.com/logicaffeine_proof/hornsat/struct.HornClause): A Horn clause `(body ⇒ head)`: the conjunction of the `body` variables implies `head`, or — when `head` is `None` — implies false (a goal/integrity clause). - [enum HornOutcome](https://docs.logicaffeine.com/logicaffeine_proof/hornsat/enum.HornOutcome): The outcome of solving a Horn system. - [fn is_refutation](https://docs.logicaffeine.com/logicaffeine_proof/hornsat/fn.is_refutation): Re-check a refutation: replaying only the listed clauses by forward chaining forces some goal clause’s body fully true (a contradiction). A solver-free certificate of unsatisfiability. - [fn satisfies](https://docs.logicaffeine.com/logicaffeine_proof/hornsat/fn.satisfies): Re-check a satisfying model: every clause holds (a rule with a true body has a true head; a goal has a false body). - [fn solve](https://docs.logicaffeine.com/logicaffeine_proof/hornsat/fn.solve): Solve a Horn system over `0..num_vars` by forward chaining. Returns the least model, or — if a goal clause is forced — a certified derivation. Linear in the total clause size. ## logicaffeine_proof::hypercube The Boolean hypercube `{0,1}ⁿ` and its subcube cover — the geometric substrate beneath SAT, and the executable form of the Lean formalization’s `HypercubeSAT`. - [struct AbstractRefutation](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.AbstractRefutation): An abstract, scale-invariant refutation: the family’s rules symmetry-broken to their orbit types, plus the abstract invariant those types violate, plus the constant-size witness. For pigeonhole this is two rule-types (every pigeon takes a hole; no two share one) and the counting fact pigeons > holes — identical at every scale. This is the lift-and-shift-left: the proof’s true size is `O(1)` in the rule-types, reached by symmetry breaking the rules to their types, never by enumerating resolvents (the concrete and even the symmetric resolution closure both explode). - [struct AdvanceStep](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.AdvanceStep): One step of the self-driving reduction: the lever applied, and the structure remaining after it. - [struct CarveStats](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.CarveStats): Autocarve — recursive carving that lets the rules fall out. Carve the formula to its core, decompose into independent components, and for each: if a certified cut recognizes it, the rule falls out and the component closes; otherwise branch one variable and carve again on each branch. Every decision cascades fresh unit propagations and pure literals, exposing structure the previous level hid — so a buried, masked, or nested invariant surfaces on its own at the depth it becomes visible. UNSAT iff any component is, SAT iff all are; `None` past the budget. What an autocarve run did: how many recursion nodes it visited, how many times a certified cut fired (a “punch”), and how deep the carving recursed. - [struct CollapseStep](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.CollapseStep): One step of the collapse curve: how many orbits remain after stacking the first `k` generators. - [struct Cover](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.Cover): A cover of the hypercube by clause-blockers — the geometric form of a CNF. UNSAT ⟺ the blockers leave no corner uncovered. - [struct CubeSym](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.CubeSym): A hypercube symmetry: permute coordinates, then optionally flip each one (`Pnp.lean`’s `CubeSymmetry`). `perm[j]` is the coordinate that `j`’s value lands on; `flip[j]` negates it. These are the automorphisms that move blockers among blockers and corners among corners with the same action — the bridge that puts rules and solutions in one mathematical world. - [struct Diagnosis](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.Diagnosis): A complete auto-diagnosis of an instance: every structure-detector run at once, so you can read off the full menu of applicable symmetry-breaks and cuts — what you can still do to it. - [struct FamilySignature](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.FamilySignature): The abstract signature of a family: its rules symmetry-broken to their orbit types, and which certified shadow (if any) refutes it. This is the auto-collapse spread across families — the same machinery that found pigeonhole’s two-type counting abstraction, applied blind to any cover. - [struct LadderStats](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.LadderStats): What a laddered branch-and-cut search did: how many subcubes (nodes) it visited, how deep it laddered, and how many subtrees a certified cut closed outright. - [struct RuleSymmetry](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.RuleSymmetry): The rule-symmetry signature of a cover: how the polynomially-many blockers collapse under the family’s automorphism group. `rule_orbits` is the count of essentially-distinct rules — a measure of structural complexity read off without enumerating the `2ⁿ` corners. A small, scale-invariant `rule_orbits` is the geometric fingerprint of a family that admits a short symmetry-broken proof. - [struct StructuralProfile](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.StructuralProfile): The structural profile of an instance — what every lever reveals about where its difficulty lives. `quotient` is the number of rule orbit-types under its discovered symmetry (how far the cube collapses); `cut` is the certified shadow that decides it, if any; `core_clauses` is what survives carving + bounded variable elimination (the irreducible residue). Together they place the instance on the spectrum from “all symmetry, O(1) quotient, instantly cut” to “no symmetry, full quotient, nothing reduces — the genuinely interesting core.” - [struct Subcube](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/struct.Subcube): A subcube of `{0,1}ⁿ`: the coordinates set in `care` are fixed to the matching bits of `value`; the rest are free. As a blocker it is the footprint of one clause — the corners that falsify it. (`Pnp.lean`’s `Blocker`, generalized from clean 3-bit faces to any width.) - [enum AdvanceStatus](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/enum.AdvanceStatus): Where `auto_advance` ended: a decided verdict, or the structureless residue (the irreducible core no structural lever could touch — where you’d branch). - [enum CarveOutcome](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/enum.CarveOutcome): What carving the hypercube reduced a formula to. - [enum CoverVerdict](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/enum.CoverVerdict): The verdict of auto-cutting a cover: which certified cut showed it total (no corner escapes), or that a corner escapes (satisfiable), or that it is not a cover the prover decides. - [enum ProofRung](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/enum.ProofRung): Where an UNSAT instance sits in the proof-complexity landscape, as our certified cuts see it. This is a ladder of proof systems (Cook–Reckhow): each rung crushes families the cheaper ones are blind to. `Counting` and `Parity` are incomparable narrow detectors — pigeonhole needs counting and is invisible to GF(2); Tseitin needs GF(2) and is invisible to counting — while `Nullstellensatz{min_degree}` is the universal algebraic height over GF(2), complete at degree `n`. The honest face of the wall: an instance whose narrow cuts are silent and whose minimum NS degree is large sits at the top of this ladder, and the cost at that height is exponential. We can locate an instance on the ladder; we cannot prove the top rung is unavoidable for a family — that lower bound is exactly P vs NP, and it stays open. - [enum SearchCost](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/enum.SearchCost): The measured cost of a branch search: either it decided within the node budget, or the search blew past it (the exponential explosion, captured rather than hung). - [enum Shadow](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/enum.Shadow): Which certified shadow refutes a cover — the abstract class of its hardness. - [fn abstract_signature](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.abstract_signature): Symmetry-break any cover to its abstract signature: discover its automorphisms, quotient the rules to orbit-types (`clause_orbits`), and probe the certified shadows in turn — counting, then parity, then cutting-planes. `shadow = None` means no shadow recognizes it (it falls through to the general certified CDCL core). A maximally symmetric family collapses to a few rule-types decided by one shadow; an unstructured one spreads across many types with no shadow — but still has a backdoor. - [fn applicable_levers](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.applicable_levers): From a `Diagnosis`, the list of symmetry-breaks and cuts that apply — the menu of moves, in order of decisiveness. Empty global structure ⟹ the honest fallback: backdoor + branch on the residue. - [fn apply_perm_to_model](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.apply_perm_to_model): Push a model through an automorphism: if `σ` preserves the clause set and `m` satisfies it, so does `σ(m)`. Variable `v`’s value lands on `σ(+v)`’s variable, negated when `σ(+v)` is the negative literal — chosen so `m ⊨ C ⟹ σ(m) ⊨ σ(C)`. - [fn apply_renaming](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.apply_renaming): Apply a flip-renaming `x_v → ¬x_v` for every `v` with `flips[v]` — a phase-flip symmetry of the cube. It permutes models bijectively (negate the flipped coordinates), so it preserves satisfiability. - [fn auto_advance](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.auto_advance): Auto-diagnose, auto-break, auto-advance — to the fixpoint. Repeatedly diagnose the instance and apply the most decisive lever it offers: a certified cut decides it outright; otherwise carve (unit / pure-literal / subsumption) and bounded variable elimination peel it down; the loop advances until a verdict drops out or no structural lever reduces it further — the structureless residue, where the only remaining move is to branch. The returned trace shows the structure draining away step by step. - [fn autocarve](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.autocarve) - [fn autocarve_measured](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.autocarve_measured): Like `autocarve`, but also returns the `CarveStats` — node count, punch count, recursion depth. - [fn automorphism_group_size](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.automorphism_group_size): The order of a formula’s automorphism group — `1` means rigid (only the identity preserves it), the maximally asymmetric extreme. Discovers the generators and closes them under composition. - [fn backdoor_branch_orbit_count](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.backdoor_branch_orbit_count): Symmetry breaking for speed. Count the orbits of the `2^{|U|}` backdoor branches (assignments to `U`) under the generators that preserve `U` setwise. A symmetry-aware solver inspects one branch per orbit instead of all `2^{|U|}` — fewer poly-time solves for the same verdict. Generators that move `U` off itself do not act on the branches and are skipped; each kept generator induces a permutation-with-flips on the backdoor positions. - [fn blocker_orbit](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.blocker_orbit): The full orbit of a blocker under the group generated by `generators` (BFS over images). For a structured family this is polynomial-sized even though `|G|` is astronomical, because the blocker’s stabilizer is huge (a pigeonhole exclusion has orbit `holes·C(pigeons,2)`, not `|G|`). - [fn bounded_variable_elimination](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.bounded_variable_elimination): Bounded variable elimination — carve away every dimension whose projection doesn’t grow the formula (resolvents ≤ clauses removed). Iterated to a fixpoint, it peels the cube down dimension by dimension wherever it’s free to do so; the variables that would explode (pigeonhole’s, by Haken) are left for the cuts. Satisfiability-preserving. - [fn burnside_corner_orbits](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.burnside_corner_orbits): Combinatorics — Burnside’s lemma. The number of corner orbits equals the average number of corners fixed by a group element: `(1/|G|) Σ_g |Fix(g)|`. A different invariant for the same count the orbit-BFS computes — counting by fixed points instead of by walking orbits. (`n ≤ ~16`.) - [fn burnside_orbit_count](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.burnside_orbit_count): Burnside orbit count — the number of essentially-distinct witnesses. By Burnside’s lemma the number of orbits of a group action equals the average number of fixed points: `#orbits = (1/|G|) · Σ_{g∈G} |Fix(g)|`, where `Fix(g) = { m : g·m = m }`. Applied to the solution set (closed under the automorphisms, since every `g` is an automorphism), this counts the witnesses up to symmetry — the essential solutions — as a fixed-point average, never enumerating an orbit. The sum is exactly divisible by `|G|` (the lemma guarantees it); `group` must be the whole group (use `perm_group_closure`). - [fn canonical_blocker](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.canonical_blocker): The orbit representative (canonical form) of a blocker under a generating set: the lexicographically minimal blocker reachable through the generators. Two blockers are symmetric iff they share a canonical form, so canonicalizing is how a symmetry-aware engine dedups derived rules by orbit. - [fn canonical_cover](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.canonical_cover): The `Bₙ`-canonical form of a cover, and its orbit size. Acts the group on the whole cover by `g·C = { g.map_subcube(b) }` and returns the lexicographically least sorted-blocker key together with the number of distinct covers in the orbit. The canonical key is constant on an orbit and distinct across orbits, a sound orbit invariant; the orbit size feeds the orbit–stabilizer identity `|Stab| · orbit_size = |Bₙ|`. - [fn canonical_model](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.canonical_model): Symmetry-break the witness. The canonical (lexicographically least) model in a witness’s orbit under the automorphisms — the symmetry-broken representative. All witnesses in one orbit reduce to the same canonical witness, so the essential content of the solution set is one canonical witness per orbit; the symmetry regenerates the rest via `model_orbit`. - [fn carve](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.carve): Carve away the hypercube. Peel the formula down by the three classic simplifications, iterated to a fixpoint: unit propagation (a unit clause carves the cube in half by forcing a variable), pure-literal assignment (carves an autark section), and subsumption (drops a blocker contained in a stronger one). All three preserve satisfiability, so the result is either a verdict or the irreducible core that genuine hardness leaves behind. Pigeonhole carves to itself. - [fn clause_orbits](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.clause_orbits): Symmetry-break the rules at the clause level — the lift-and-shift-left form that scales to any number of variables. Partition the clause indices (the blockers) into orbits under a generating set of automorphisms, applying each `Perm` to clause literals directly via the canonical `clause_key`. A blocker is a clause, so this is the same rule-quotient as `Cover::blocker_orbits` — but with no `2ⁿ` corner geometry and no 63-variable ceiling, so it runs at scales where the cube is astronomically large. The orbit count is the number of essentially-distinct rules. (Generators that move a clause off the set are simply not followed — only genuine rule-automorphisms close orbits.) - [fn clauses_to_expr](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.clauses_to_expr): Build the CNF `ProofExpr` over atoms `x{var}` from raw clauses — the door into the certified prover, scalable (no cube). `None` on an empty clause or empty formula. - [fn collapse_curve](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.collapse_curve): Stack the generators one at a time and record how the orbit count shrinks — the executable answer to “how much does each symmetry break cut the problem?” Begins at `2ⁿ` (no symmetry) and descends as generators compose. The ratios are measured, not asserted. - [fn components](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.components): Partition a formula into its independent components — maximal clause groups sharing no variable (the connected components of the variable-interaction graph). The formula is the conjunction of its components, so it is UNSAT iff any component is, and each can be attacked on its own. A structured UNSAT component buried in a big mixed formula — invisible to the monolithic cut — is laid bare here. - [fn crush](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.crush): The unified crush. Compose every lever into one decision procedure: carve the autark sections (pure literals), split into independent components, and decide each by the cut-enabled symmetry-aware search — a component refuted by a certified cut at the root closes in one node, the rest fall to bounded branch-and-cut. The formula is UNSAT iff any component is, SAT iff all are. Returns `None` only when a component blows past the budget — the genuinely hard residue, honestly surfaced rather than hidden. - [fn cube_group_closure](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.cube_group_closure): The full group generated by `generators`, materialized (closure under composition) — the public door onto the otherwise-internal `group_closure`. For the small groups the census needs (`Bₙ`, `n ≤ 5` ⇒ `|G| = 3840`) the orbit–stabilizer cross-checks sum over every element. - [fn decide_2sat](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.decide_2sat): Decide a width-≤2 CNF in polynomial time via the 2-SAT SCC solver. `true` = satisfiable. An empty clause forces UNSAT. Panics if handed a clause wider than 2 (not a 2-SAT instance). - [fn decide_laddered](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.decide_laddered): Ladder up the hypercube: crush what we can, brute-force the rest. Branch-and-cut over `{0,1}ⁿ`, one variable at a time — exactly DPLL with our certified cuts as the theory: - [fn decide_laddered_nocut](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.decide_laddered_nocut): The baseline the symmetry-pruned search is measured against: the same branch engine with no cut and no generators (so `violates_lex_leader` never fires). Isolates the effect of symmetry pruning. - [fn decide_laddered_sym](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.decide_laddered_sym): Symmetry-break the search itself. The same branch-and-cut ladder, but it branches variables in index order and prunes a node whenever a root automorphism maps its decided prefix to a lexicographically smaller decided assignment — classic lex-leader symmetry breaking during search. Sound by construction: every orbit of assignments keeps exactly one lex-leader, and only strict non-leaders are pruned, so the verdict never changes; symmetric subtrees are simply skipped. The automorphisms are discovered once at the root. - [fn decide_sat_via_2sat_backdoor](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.decide_sat_via_2sat_backdoor): Decide satisfiability through a 2-SAT backdoor: the instance is satisfiable iff some fixing of `U` leaves a satisfiable 2-SAT residual. This solves in `2^{|U|}` polynomial branches instead of a `2ⁿ` search — the structure (the backdoor) turned an exponential into a small, easy fan-out. `U` must be a strong backdoor to 2-SAT (every residual width ≤ 2). - [fn decompose_and_crush](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.decompose_and_crush): Decompose into independent components and crush: return `true` (UNSAT) the moment any component is refuted by a certified cut, never having examined the rest. Isolating a structured UNSAT component unlocks a cut the monolithic formula hides. - [fn diagnose](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.diagnose): Run every lever’s detector and report what applies. The automated “what can we still do” — one call, the whole portfolio probed. - [fn eliminate_variable](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.eliminate_variable): Carve out a dimension. Eliminate variable `v` by resolution (Davis–Putnam): drop every clause mentioning `v`, and add the non-tautological resolvents of each `v`-clause against each `¬v`-clause. Geometrically this projects the cube’s `v`-axis away — the formula over `n` dimensions becomes an equisatisfiable one over `n-1`. Sound: a model of the projection lifts to a model of the original. - [fn face_vector](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.face_vector): Geometry — the f-vector. The number of blockers of each face dimension. A symmetry permutes blockers among themselves but preserves each one’s dimension, so the f-vector is a geometric invariant of the cover (the discrete analog of a polytope’s face counts). - [fn find_random_core](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.find_random_core): Find the randomness. Strip every structural lever — a certified cut decides it (so there was no irreducible randomness), carve (unit/pure/subsumption) and bounded variable elimination peel structure away — and return what survives: the irreducible core. `None` means the instance was fully structured and got decided. `Some(core)` is the kernel where carving can do no more; check it with `diagnose` — if it also has no cut and ~zero symmetry-bits, that is the randomness, isolated. - [fn greedy_2sat_backdoor](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.greedy_2sat_backdoor): Greedily find a backdoor to 2-SAT: a set of variables `U` such that every clause has at most two literals outside `U`. Then under any assignment to `U`, each clause is either satisfied or shrinks to width ≤ 2, so the residual is 2-SAT — poly-decidable. Built by repeatedly fixing the variable that appears in the most still-too-wide clauses (a hitting set of the wide clauses). - [fn hyperoctahedral_generators](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.hyperoctahedral_generators): Generators of the full hyperoctahedral group `Bₙ = (ℤ/2)ⁿ ⋊ Sₙ` — the signed permutations, the automorphism group of the `n`-cube and the complete clause-level symmetry: every `CubeSym` is one of its elements. The `n−1` adjacent coordinate transpositions generate `Sₙ`; the single coordinate-0 flip, conjugated by those, generates the `(ℤ/2)ⁿ` of phase flips; together they generate all of `Bₙ`. The `cube_group_closure` of these has order exactly `2ⁿ·n!` (`1, 2, 8, 48, 384, 3840` for `n = 0..=5`). The census quotients minimal covers by this group. - [fn is_antipodally_symmetric](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.is_antipodally_symmetric): Is the cover invariant under the antipodal map — global negation `x → ¬x`, the center-inversion of the cube? True iff flipping every literal of every clause maps the clause set onto itself. This is a symmetry axis distinct from coordinate permutation: it is the involution whose unique fixed point is the ½-center (`CubeSym::map_fractional` with all flips and no permutation fixes `½ⁿ`). When it holds, satisfying assignments come in antipodal pairs `{a, ¬a}`, so one variable’s value is free WLOG. - [fn is_strong_backdoor_to_2sat](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.is_strong_backdoor_to_2sat): Verify `U` is a strong backdoor to 2-SAT by enumeration: every one of the `2^{|U|}` assignments to `U` yields a residual of width ≤ 2. Bounded to `|U| ≤ 24` (the enumeration guard). - [fn is_total_via_orbits](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.is_total_via_orbits): The symmetry-broken cover-totality check: when every generator is a verified automorphism, the cover is total iff it covers one representative per orbit. Same verdict as `Cover::is_total`, but it inspects `orbit_count` corners instead of `2ⁿ`. `None` (fail-closed) when some generator is not actually an automorphism — never a guessed answer. - [fn min_resolution_width](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.min_resolution_width): The minimum width of a resolution refutation of an UNSAT cover — the size of the widest clause any width-bounded refutation must carry, the classic resolution complexity measure (Ben-Sasson– Wigderson). A subcube is a clause (`Subcube::clause_literals`) and `Subcube::resolve` is the geometry of the resolution step; the empty subcube (`care = 0`, the whole cube blocked) is the derived contradiction. For width budget `w` we seed with the input blockers of support `≤ w` and saturate under width-`≤ w` resolution; the least `w` that derives the empty subcube is the width. `None` only if the cover is satisfiable (no refutation at any width); every UNSAT cover succeeds by `w = n` since full-width resolution is complete. (For small covers — it enumerates resolvents.) - [fn minimal_cover_orbits](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.minimal_cover_orbits): Enumerate every minimal UNSAT cover of the `n`-cube, one canonical representative per `Bₙ` orbit. A minimal cover is a set of subcube blockers that covers every corner (UNSAT) and none of which is droppable (every blocker privately owns some corner) — i.e. a minimal unsatisfiable CNF (an MUS), the irreducible atom of the UNSAT universe. Branch on the lex-least uncovered corner: it lies in exactly `2ⁿ` subcubes (one per support `care ⊆ [n]`, with `value = corner & care`); recurse on each. Monotone pruning kills a branch the moment any chosen blocker becomes fully redundant (it can never recover a private corner once one is stolen). A leaf is total ∧ fully essential; leaves are folded to their `canonical_cover` key so each orbit is reported once. (Exhaustive; for small `n`.) - [fn model_orbit](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.model_orbit): Symmetry generates solutions. From one model, the entire orbit under a generating set of automorphisms — every member a model too, produced with no search. The generative dual of resolution (which begets rules from symmetry); here symmetry begets solutions. - [fn orbit_count](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.orbit_count): How many orbits the corners fall into under these generators. - [fn orbit_representatives](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.orbit_representatives): Orbit partition of the `2ⁿ` corners under a set of generators, each a verified automorphism. Returns one representative per orbit (the orbit-collapsed corner set the cover check needs). Materializes a `2ⁿ` seen-bitmap, so this is itself bounded by the hypercube size — it measures the collapse rather than escaping it; the counting/parity shadows are what decide totality without the `2ⁿ` walk. Honest by construction. - [fn partition_into_orbits](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.partition_into_orbits): Symmetry-aware solution counting. Partition a set of models into orbits under a generating set of automorphisms; each orbit is the full `model_orbit` of any of its members. The solution count is the sum of the orbit sizes, so a symmetric instance collapses to one representative per orbit — far fewer than the solutions themselves. (`models` should be closed under the symmetry, e.g. all models.) - [fn perm_group_closure](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.perm_group_closure): The full symmetry group: every distinct `Perm` reachable by composing the generators (closure under composition). Small-group only — the orbit-stabilizer accounting below needs the whole group, not a generating set. Includes the identity. - [fn php_cover](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.php_cover): The pigeonhole cover: `n` pigeons into `n-1` holes. Variable `(p,h)` (“pigeon `p` in hole `h`”) lives at index `p*(n-1)+h`, matching `crate::families::php`. Always buildable, always UNSAT. - [fn php_perm_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.php_perm_symmetries): The pigeonhole grid symmetry group `Sₙ × Sₙ₋₁` as scalable `Perm`s — adjacent pigeon (row) and hole (column) transpositions over the `n*(n-1)` grid variables. No `u64` cap. - [fn php_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.php_symmetries): The generating symmetries of the pigeonhole cover: adjacent transpositions of pigeons (rows) and of holes (columns). Together they generate the full grid symmetry group `Sₙ × Sₙ₋₁` — pure coordinate permutations (no phase flips). Each is a `CubeSym` over the `n*(n-1)` grid variables. - [fn pigeonhole_abstract_refutation](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.pigeonhole_abstract_refutation): Symmetry-break pigeonhole to its abstract certificate. The rules collapse (via `clause_orbits`) to exactly two types regardless of `n`; the abstract invariant on those types is Hall’s condition, witnessed by the `O(1)` counting certificate pigeons > holes. The whole certificate is constant in size and identical in shape at every scale — the auto-collapse of pigeonhole, lifted to the type level where it actually scales. `None` only in the degenerate hole-free case. - [fn pigeonhole_rule_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.pigeonhole_rule_symmetry): The rule-symmetry signature of pigeonhole at scale `n`, computed at the clause level with the full grid group `Sₙ × Sₙ₋₁`. The blocker set grows superlinearly and the cube has `2^{n(n-1)}` corners, yet the rules always collapse to exactly two orbits — the complexity limit symmetry exposes, computable at any `n` because it never touches the cube. - [fn pure_literal_reduce](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.pure_literal_reduce): Cut out the autark sections. A pure literal (a variable appearing in only one polarity) is the simplest autarky: assigning it satisfies every clause it touches, so that whole section of the cube is removed without affecting satisfiability. Iterate to a fixpoint and what remains is the hard core — the part with no free section to cut. Returns `(core clauses, assigned pure literals)`. Sound: pure- literal elimination preserves satisfiability (Davis–Putnam). - [fn renaming_to_horn](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.renaming_to_horn): Recognize a new symmetry: renamable-Horn. Is there a flip-renaming under which every clause has at most one positive literal (Horn)? Horn-SAT is polynomial (unit propagation finds the least model), so a renamable-Horn formula is in a poly class our field cuts cannot see. Crucially, finding the renaming is itself a 2-SAT: a clause is Horn-after-flip iff no two of its literals are both positive, and “literal `l` is positive after flip” is the single `f`-literal `(l.var, l.is_positive)`. Returns the flip-set, or `None` if no renaming makes it Horn. - [fn restrict](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.restrict): The residual CNF after fixing variables: `assignment[v] = Some(b)` fixes `v`, `None` leaves it free. Clauses satisfied by a fixed literal are dropped; falsified literals are removed. An empty clause in the result means the restriction already falsifies the formula. - [fn search_cost](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.search_cost): Run the branch engine purely to measure its size, with `use_cut` selecting whether the certified cuts fire, and a hard `budget` on visited nodes so a resolution-class explosion is recorded as `Exceeded` instead of running forever. With the cut off this is raw DPLL (resolution-strength); with it on, the certified cut closes whole subtrees. The apples-to-apples gap between the two is the campaign’s thesis, quantified. - [fn search_cost_antipodal](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.search_cost_antipodal): Recursive antipodal symmetry breaking. Branch search that, at every node, re-detects whether the residual is antipodally symmetric (`is_antipodally_symmetric`); when it is, it fixes the pivot to `false` WLOG and prunes the `true` branch — soundly, since the residual’s models come in antipodal pairs. A disjoint union of self-complementary blocks keeps regaining the symmetry as each block’s first variable is fixed, so the break fires recursively, collapsing one factor of 2 per block. - [fn stabilizer](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.stabilizer): The stabilizer of a witness — the subgroup of symmetries that fix it (`σ·m = m`). These are the transformations under which the witness sees itself; they are exactly the redundancy in its perspective of the others. - [fn structural_profile](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.structural_profile): Profile an instance: collapse its rules to orbit-types, probe which cut decides it, and carve it to its irreducible core. The reading that emerges — quotient size tracks cut-decidability tracks core reducibility — is the single axis underneath every lever: difficulty is quotient size. - [fn symmetric_resolution_closure](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.symmetric_resolution_closure): Symmetric resolution closure on orbit representatives: resolve each representative against every image in another representative’s orbit. Since resolution commutes with symmetry — `σ(resolve(c,d)) = resolve(σc,σd)` — this captures every derivable rule up to symmetry without building the raw exponential closure. Returns the saturated count of orbit-types and whether the empty clause (a refutation) was derived, bounded by `max_rounds` and a `max_reps` size guard. - [fn symmetric_resolution_growth](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.symmetric_resolution_growth): Symmetric resolution closure — rules beget rules, collapsed by symmetry. From a cover’s blockers, repeatedly resolve all pairs (each resolvent a new rule) and record, per round, both the raw count of distinct derived rules and the count of their orbit representatives under the automorphism group. The widening gap between the two is the symmetry collapse of the resolution proof: raw resolution explodes, but modulo symmetry only a handful of essentially-distinct rules are ever derived — the geometric reason symmetric proof systems refute pigeonhole in polynomial size where plain resolution cannot. - [fn symmetry_entropy_bits](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.symmetry_entropy_bits): Information theory — the bits of symmetry. `log₂|Aut|` is the symmetry-entropy: the number of bits the automorphism group compresses out of the formula’s description (knowing one orbit representative plus the group recovers the rest). High for symmetric structure, exactly `0` for a rigid one — and that zero is the maximal-information, incompressible extreme. - [fn walsh_hadamard_energy](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.walsh_hadamard_energy): Analysis — the Walsh–Hadamard (Fourier) spectrum. Expand the cover’s vertex-energy function over the cube’s characters `χ_S(x) = (-1)^{⟨S,x⟩}`: `f̂(S) = 2⁻ⁿ Σ_x energy(x) χ_S(x)`. Harmonic analysis on the hypercube — the coefficients are the analytic invariant. (`n ≤ ~16`.) - [fn weakest_crushing_rung](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.weakest_crushing_rung): Locate an instance on the `ProofRung` ladder: the weakest certified cut that crushes it, probed cheapest-first (carve ≺ counting ≺ parity ≺ Nullstellensatz-by-degree). The narrow rungs (`Counting`, `Parity`) are incomparable; probe order only decides the label when more than one happens to fire. - [fn weakest_crushing_rung_with_char](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.weakest_crushing_rung_with_char): `weakest_crushing_rung` with the characteristic rungs enabled — the same cascade, plus, between the parity probe and the algebraic ascent, a certified mod-`p` cut per prime in `primes`: when the CNF is a recognized one-hot encoding of a `GF(p)` linear system (`crate::modp::recover_from_cnf`, which declines rather than guesses) and the `GF(p)` Gaussian refutation re-checks (`crate::modp::is_refutation`), the instance lands on `ProofRung::ModCount`. This is the ladder rung the census’s `router_beats_ladder` audit flagged as missing: the structured router’s `Route::ModP` specialist finally has a certified proof system the ladder can name. With `primes = &[]` the cascade is exactly the legacy one. - [fn witness_perspective](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/fn.witness_perspective): Symmetry-break across the witness’s perspective of the other witnesses. From witness `m`, every other witness in its orbit is reached by some symmetry — but many symmetries land on the same one (they differ by a stabilizer element of `m`). The symmetry-broken perspective quotients that redundancy out: exactly one representative transformation per distinct witness `m` can see — a transversal of the coset space `G / Stab(m)`. The returned `(witness, σ)` pairs satisfy `σ·m = witness`, and their count is `|G| / |Stab(m)| = |orbit(m)|` (orbit–stabilizer). The first entry is `(m, identity)`: the witness’s view of itself. - [type Corner](https://docs.logicaffeine.com/logicaffeine_proof/hypercube/type.Corner): A corner (vertex) of the hypercube `{0,1}ⁿ`: bit `v` holds the value of variable `v`. Enumeration routines assume `n ≤ 63`; the algebra itself is width-agnostic. ## logicaffeine_proof::hyperelliptic Genus-2 curves and the Richelot (2,2)-isogeny — the abelian-surface mechanism - [struct MatchedPairGlue](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/struct.MatchedPairGlue): A matched-pair (2,2)-gluing: the genus-2 curve `C: y² = ∏ᵢ(x² + cᵢx + 1)` whose Jacobian is `(2,2)`-isogenous to `E₁ × E₂`, where `E₁, E₂` share three of the four quartic 2-torsion roots `−cᵢ` and differ in the fourth (`∓2`). Derived from the involution `x ↦ 1/x` (invariants `t = x + 1/x`, `w = y(x³+1)/2x³`, giving `W = 2w/(t−1)` with `W² = (t+2)∏(t+cᵢ)`). Unlike the even-sextic special case, this is the general gluing along a matched 2-torsion; any two curves with a symplectic 2-torsion isomorphism reach this form after a Möbius normalization of the shared points. Validated exactly by `#Jac(C) = #E₁·#E₂` (`genus2_jacobian_order`). - [struct Mumford](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/struct.Mumford): A divisor class in `Jac(C)` in Mumford form `(u, v)`. - [struct Richelot](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/struct.Richelot): The result of a Richelot (2,2)-isogeny from a quadratic splitting `f = G₁·G₂·G₃`. - [struct SplitGenus2](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/struct.SplitGenus2): A genus-2 curve `C: y² = g(x²)` (an even sextic) with a (2,2)-split Jacobian `Jac(C) ~ E₁ × E₂`, together with its two elliptic quotients. This is the (2,2)-gluing in reverse: the two degree-2 maps `(x,y) ↦ (x², y)` onto `E₁: y² = g(u)` and `(x,y) ↦ (1/x², y/x³)` onto `E₂: y² = ĝ(u)` (the reversed cubic) exhibit the split. It is the abelian-surface object the Kani/Castryck–Decru oracle detects. - [enum GuidedWalk](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/enum.GuidedWalk): The outcome of following a guided Richelot chain. - [fn cantor_add](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.cantor_add): Cantor’s algorithm: add two divisor classes on `C: y² = f(x)` (genus 2, `char ≠ 2`). - [fn count_curve_fp](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.count_curve_fp): `#{(x,y) ∈ 𝔽_p² : y² = f(x)} + inf` — the `𝔽_p`-point count of `y² = f(x)` (`inf` = points at infinity). - [fn find_split_neighbour](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.find_split_neighbour): Walk the (2,2)-isogeny graph from a genus-2 Jacobian given by its six Weierstrass points: try each of the 15 Richelot neighbours and report whether any is a split (reducible) surface. This is the shape of the Castryck–Decru search — at real scale it is guided by the torsion images rather than exhaustive, and Robert’s generalisation lifts the same walk to dimension 4/8. Returns the splitting quadratics of the first split neighbour, if one exists. - [fn genus2_jacobian_order](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.genus2_jacobian_order): `#Jac(C)(𝔽_p)` for the genus-2 curve `C: y² = f(x)` (deg f = 6, monic), from its L-polynomial via the point counts over `𝔽_p` and `𝔽_{p²}`. For a split Jacobian `Jac(C) ~ E₁ × E₂` this equals `#E₁·#E₂` (Tate: isogenous abelian varieties over `𝔽_p` share their order) — the exact point-count validation of a gluing. - [fn genus2_jacobian_order_general](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.genus2_jacobian_order_general): `#Jac(C)(𝔽_p)` for `C: y² = f(x)` of any degree 5 or 6, with the correct number of points at infinity: deg 5 ⟹ 1; deg 6 ⟹ 2 if the leading coefficient is a square (over `𝔽_p`), else 0. Over `𝔽_{p²}` every `𝔽_p` leading coefficient is a square, so the count there is 2 (deg 6) or 1 (deg 5). Needed to compare a Richelot dual (a non-monic, possibly quadratic-twisted sextic) against its domain. - [fn glue_shared_2torsion](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.glue_shared_2torsion): Glue two elliptic curves along their matched 2-torsion `{−c₁, −c₂, −c₃}` into the genus-2 curve `C: y² = ∏(x² + cᵢx + 1)`. See `MatchedPairGlue`. - [fn guided_chain](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.guided_chain): Follow a guided chain of Richelot isogenies: apply the neighbour named by each index in `path` in turn, reporting the first split. In the full Castryck–Decru attack the path is not free — it is dictated by the torsion images `φ(P), φ(Q)`: the kernel of each (2,2)-step is the image of a prescribed torsion subgroup, so the walk is a single guided line rather than the 15-way exhaustive tree. This function is that guided line; deriving `path` from the torsion images is the remaining Castryck–Decru integration. - [fn jac_element_order](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.jac_element_order): The order of a divisor class `D` in `Jac(C)` — the least `n | group_order` with `[n]·D = 0`. Computed by stripping each prime of `group_order` as far as still annihilates `D`. - [fn jac_identity](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.jac_identity): The identity divisor class `(1, 0)`. - [fn jac_negate](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.jac_negate): `−D = (u, −v)`. - [fn jac_scalar_mul](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.jac_scalar_mul): Scalar multiple `[n]·D` by double-and-add. - [fn poly_deriv](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.poly_deriv): Formal derivative of a polynomial mod `p`. - [fn poly_eval](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.poly_eval): Evaluate a polynomial at `x` mod `p` (Horner). - [fn poly_mul](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.poly_mul): Polynomial product mod `p` (coefficients low-to-high). - [fn richelot](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.richelot): The Richelot (2,2)-isogeny from a quadratic splitting `G = (G₁, G₂, G₃)` over `𝔽_p`. - [fn richelot_chain](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.richelot_chain): Walk chains of Richelot (2,2)-isogenies to depth `depth` (a chain of `depth + 1` steps), returning the sequence of neighbour indices that first reaches a split (reducible) surface, or `None` if none does within the bound. This is the recursive form of the Castryck–Decru search across the (2,2)-graph: from each node it forms the codomain, extracts its Weierstrass points, and recurses. Neighbours whose codomain 2-torsion escapes to `𝔽_{p²}` are skipped over the prime field. - [fn richelot_partitions](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.richelot_partitions): The 15 quadratic splittings of six roots into three pairs — the neighbours of a genus-2 Jacobian in the (2,2)-isogeny graph. Each pair `(rₐ, r_b)` becomes the quadratic `(x−rₐ)(x−r_b)`. - [fn select_splitting_branch](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.select_splitting_branch): The per-digit split oracle. Given the candidate surface for each branch of the recursive descent (one per guessed `ℓ`-adic digit — in the full attack each is built by Kani gluing from the torsion images and the guess), return the index of the branch whose surface splits. The split-test prunes every branch but the consistent one — the `is_split`/Kani step of Castryck–Decru, as a wired per-digit selector. - [fn split_jacobian_from_cubic](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.split_jacobian_from_cubic): Glue `E₁: y² = g(u)` with its reverse `E₂: y² = ĝ(u)` into the genus-2 curve `C: y² = g(x²)`. `g` is a cubic given low→high `[g₀, g₁, g₂, g₃]`. The result carries a split Jacobian — validated by the quotient maps and by the Richelot `±`-splitting being reducible (`δ = 0`). - [fn surface_is_reducible](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/fn.surface_is_reducible): Whether the genus-2 curve with these six Weierstrass points has a reducible Jacobian (splits as a product of elliptic curves) — decided by the Richelot split-test: some `(2,2)`-splitting has `δ = 0`. This is exactly the decision the Castryck–Decru per-digit oracle makes — a correct guess yields a splitting abelian surface, a wrong one an indecomposable genus-2 Jacobian. - [type Quad](https://docs.logicaffeine.com/logicaffeine_proof/hyperelliptic/type.Quad): A quadratic `g₀ + g₁·x + g₂·x²`, coefficients low-to-high. ## logicaffeine_proof::inprocess Certified inprocessing: clause-database simplifications that emit a machine-checkable proof. - [enum EquivResult](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/enum.EquivResult) - [fn bucket_elimination_refute](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/fn.bucket_elimination_refute): Full Davis–Putnam bucket elimination in min-degree order, allowing intermediate growth but capping every resolvent at `width_cap`. If it reaches `⊥`, returns the RUP-resolvents-then-deletions proof — a width-`≤width_cap` resolution refutation, i.e. a `2^width_cap·n` certificate that crushes every bounded-treewidth family. Returns `None` the moment a resolvent would exceed the cap (high treewidth — the certificate would be exponential, which is exactly the Ben-Sasson–Wigderson hardness). Sound: every step is RUP/Delete and independently re-checkable by `crate::pr::check_pr_refutation`. - [fn bve](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/fn.bve): Bounded variable elimination over the whole formula: repeatedly eliminate every variable whose elimination is non-growing, until a fixpoint (capped at a few passes). Returns the simplified clause set and the composed proof steps. - [fn eliminate_variable](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/fn.eliminate_variable): Try to eliminate variable `x` from `clauses` by Davis-Putnam resolution. Returns the new clause set and the proof steps (RUP resolvents, then the deletions of `x`’s clauses) — but only when `x` actually occurs and elimination does not grow the clause count (the standard BVE bound). `None` otherwise. Verdict-invariant: a model of the result extends to a model of the input. - [fn equivalent_literal_scc](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/fn.equivalent_literal_scc) - [fn vivify](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/fn.vivify): Vivify the whole database: replace each clause with its RUP-strengthened form, emitting an `Rup(shorter)` then `Delete(original)` per improvement. Shorter clauses propagate and delete better. The composed steps keep the run independently checkable. - [fn vivify_clause](https://docs.logicaffeine.com/logicaffeine_proof/inprocess/fn.vivify_clause): Vivify a clause: drop every literal whose removal leaves a clause still RUP-implied by `db`. Returns the strengthened (shorter) clause, or `None` if nothing could be removed. The result is a sub-clause logically equivalent in context, so it is verdict-invariant. ## logicaffeine_proof::interval_replay Independent range-safety checker for analog netlist claims — the trust core of the analog lane’s `RangeCertificate`, in the same spirit as this crate’s PR/RUP checker: a small, dependency-free replay the certificate producer cannot influence. - [struct RangeClaim](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/struct.RangeClaim): The claim under judgment: declared math-domain input boxes, per-net power-of-two scales, claimed VOLT-domain per-node bounds, and the physical envelope they must respect. - [enum RCell](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/enum.RCell): The neutral cell vocabulary the checker replays. Mirrors (but does not import) the analog lane’s tile set; the producer converts its netlist into this form to be judged. - [enum RSrc](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/enum.RSrc): An operand of a replayed cell: a plane input, a prior cell’s net, or a programmed constant. - [fn check_integrator_claim](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/fn.check_integrator_claim): Replay a MULTI-STATE INTEGRATOR claim: the cells run once per frame over the held state vector (starting inside the `init` boxes); `outs[s]` gives state `s`’s next value. The claim’s input boxes must contain every frame’s state vector (the trajectory hull), and the per-node claims must contain the per-frame hulls, inside the rails / above the noise floor. - [fn check_range_claim](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/fn.check_range_claim): Replay the claim and judge it. `true` iff every check passes; ANY malformation (arity mismatch, dangling reference, non-finite number, inverted interval) is `false` — fail-closed. - [fn check_reduction_claim](https://docs.logicaffeine.com/logicaffeine_proof/interval_replay/fn.check_reduction_claim): Replay a STREAMED-REDUCTION claim: the same cells run once per frame with input 0 the element box and input 1 the carried accumulator (starting at `init`); the claim’s per-node bounds must contain the HULL of every frame’s replayed bounds, the claim’s input-1 box must contain the whole accumulator trajectory, and every claimed bound must respect the rails and the noise floor. Fail-closed on any malformation, divergence, or a frame count of zero. ## logicaffeine_proof::interval_sched Interval scheduling in O(n log n) via a sweep line — the matching/Hall reasoner reaching into resource allocation over time. - [struct Interval](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/struct.Interval): A half-open task interval `[start, end)`. - [enum ScheduleOutcome](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/enum.ScheduleOutcome): The outcome of scheduling onto `m` machines. - [fn is_overflow_witness](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/fn.is_overflow_witness): Re-check an overflow witness: all the listed tasks pairwise overlap and there are more than `machines` of them — a clique that cannot be coloured with `machines` colours. - [fn is_valid_schedule](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/fn.is_valid_schedule): Re-check a schedule: every assigned machine is in range and no two overlapping tasks share one. - [fn peak_concurrency](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/fn.peak_concurrency): The peak number of tasks active simultaneously — the interval graph’s clique number / chromatic number, i.e. the fewest machines (or registers) that suffice. One sweep, O(n log n). - [fn schedule_or_overflow](https://docs.logicaffeine.com/logicaffeine_proof/interval_sched/fn.schedule_or_overflow): Decide whether `tasks` can be scheduled on `machines` machines. Sweeps the endpoints to find the peak overlap: feasible iff that peak is ≤ `machines`, with a greedy interval colouring as the assignment, else the overflowing overlap-clique as the certificate. ## logicaffeine_proof::isogeny Certified isogeny torsion-image witnesses — the SIDH/SIKE public-data structure, in the prover - [struct KaniDiamond](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/struct.KaniDiamond): A Castryck–Decru Kani diamond: a secret isogeny `φ: E₀ → E` of degree `d` and an auxiliary isogeny `γ: E₀ → C` of degree `c`, chosen so `c + d = 2^e`. Kani’s lemma then supplies a `(2^e, 2^e)`-isogeny of the abelian surface `E × C` — a length-`e` Richelot chain — whose codomain splits into a product of elliptic curves iff the diamond is consistent. The split-test (`crate::hyperelliptic::surface_is_reducible`) is the per-digit oracle that reads that splitting off. Honest boundary: this builds and validates the diamond’s degree structure and both isogeny sides; constructing the surface’s `2^e`-torsion kernel from the diamond and the torsion images — the input the split-oracle consumes — is the remaining SageMath-scale research core and is not fabricated here. - [struct KaniGlue](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/struct.KaniGlue): A Kani glue kernel: the graph `{(T, φ(T))}` of an isogeny on the `N`-torsion, the candidate kernel of an `(N,N)`-isogeny of the abelian surface `E × E'`. - [struct SecretRecovery](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/struct.SecretRecovery): A recovered SIDH secret together with the self-checking record of the laws its recovery invoked. The certificate carries everything needed to re-derive itself: `verify` re-runs every law from scratch, trusting nothing about how the answer was produced. This is the auto-formalizing recovery — it inverts images → generator and emits the re-checkable mathematics it stands on. - [struct TorsionImageWitness](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/struct.TorsionImageWitness): A re-checkable witness that an isogeny `φ: E → E'` is consistently specified by its action on an `N`-torsion basis — the SIDH/SIKE public-key format. - [enum RecoveryLaw](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/enum.RecoveryLaw): A law the recovery invoked — auto-formalized as a re-checkable obligation, not prose. The recovery engine does not merely return an answer; it pops out the rules and laws it relied on, each of which `SecretRecovery::verify` re-derives from scratch. - [enum SidhAudit](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/enum.SidhAudit): The structural verdict on SIDH/SIKE-style public data. - [fn audit](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.audit): Audit an isogeny public key: consistent, and what does it structurally expose? - [fn build_kani_diamond](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.build_kani_diamond): Build a Kani diamond over `𝔽_{p²}`: the secret side `φ` is an `ell_phi^a`-isogeny with kernel `⟨phi_gen⟩`; the auxiliary side `γ` is a `c`-isogeny (`c` an odd prime) with kernel `⟨gamma_gen⟩`. Succeeds only when `c + ell_phi^a` is a power of two — the Kani degree condition. - [fn build_kani_glue](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.build_kani_glue): Build a genuine Kani glue kernel over `𝔽_{p²}` from a real `ell`-isogeny and an `N`-torsion basis. - [fn certify_isogeny](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.certify_isogeny): Build a genuine certified witness: the real `ell`-isogeny with kernel `⟨kernel_gen⟩` on `domain`, together with the images of an actual `E[n]` basis (`n` coprime to `ell`, so `φ` is an isomorphism on the `n`-torsion). Its `verify()` passes by construction. `None` if the isogeny or basis cannot be formed. - [fn certify_recovery](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.certify_recovery): Certify an images → generator recovery, emitting the answer with its self-checking law record. Runs the flat recovery for the answer, then attaches the full set of re-checkable laws (order, descent, image reproduction, the faithful ℓ-adic tree partition, and the Aut-orbit closure rule). - [fn is_smooth](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.is_smooth): Whether `n` is `bound`-smooth (every prime factor ≤ `bound`) — the auxiliary isogeny degree of a Kani diamond must be smooth to be efficiently computable. - [fn kani_diamond_degrees](https://docs.logicaffeine.com/logicaffeine_proof/isogeny/fn.kani_diamond_degrees): The Kani degree condition. To embed a degree-`d` secret isogeny in a `(2,2)`-isogeny chain of an abelian surface (the Castryck–Decru diamond), pick an exponent `e` and an auxiliary isogeny of degree `c = 2^e − d`, so the two sides of the diamond sum to `2^e` — the surface isogeny is then a length-`e` Richelot chain. `c` must be positive and smooth (efficiently computable). Returns the smallest such `(e, c)`. This is the diamond’s number-theoretic bookkeeping. ## logicaffeine_proof::kan_complex Actually having an ∞-groupoid — not its invariants, the object itself, with its defining property machine-verified. - [fn inner_horns_fill_uniquely](https://docs.logicaffeine.com/logicaffeine_proof/kan_complex/fn.inner_horns_fill_uniquely): Does every compatible inner horn (`0 < k < n`) fill uniquely? Unique inner fillers are the signature of a 1-truncated nerve — the ∞-groupoid is exactly `K(G,1) = BG`, no genuine higher cells. - [fn kan_fills](https://docs.logicaffeine.com/logicaffeine_proof/kan_complex/fn.kan_fills): Does the nerve satisfy the Kan condition for horns `Λⁿ_k` — does every compatible horn fill? - [fn nerve_cohomology_size](https://docs.logicaffeine.com/logicaffeine_proof/kan_complex/fn.nerve_cohomology_size): The simplicial cohomology `|Hⁿ(BG; A)|` of the nerve `BG = K(G,1)`, computed from the nerve’s own face maps. By the Eilenberg–MacLane representing property `Hⁿ(BG; A) = [BG, K(A,n)]`; we confirm it equals the algebraic group cohomology `Hⁿ(G; A)`, so the spectrum represents — on the symmetry’s classifying space — exactly group cohomology, the home of the Postnikov k-invariants. ## logicaffeine_proof::lattice LLL lattice reduction — the geometric lens of the compression campaign. - [fn lll_reduce](https://docs.logicaffeine.com/logicaffeine_proof/lattice/fn.lll_reduce): LLL-reduce an integer lattice basis (the rows of `basis`), returning a reduced basis of the same lattice with short, nearly-orthogonal vectors. Exact arithmetic throughout (Gram–Schmidt over the rationals, size reduction with `|μ| ≤ ½`, the Lovász swap at `δ = ¾`), so the result is a certified LLL-reduced basis. The first row is a short vector — for a lattice built to encode a cryptographic weakness, that short vector is the leaked secret. - [fn lll_reduce_bigint](https://docs.logicaffeine.com/logicaffeine_proof/lattice/fn.lll_reduce_bigint): LLL-reduce a `BigInt` lattice basis — the entry point for lattices with huge entries, such as the `N^m`-scaled rows of Coppersmith’s method. The symmetry that makes this fast: only the BASIS need be exact; the Gram–Schmidt that steers the size-reductions and Lovász swaps runs in floating point, so there is no rational coefficient blow-up. The reduced basis is still exact integer, and correctness is re-checked downstream (a Coppersmith root either divides `N` or it does not). - [fn lll_reduce_bigint_exact](https://docs.logicaffeine.com/logicaffeine_proof/lattice/fn.lll_reduce_bigint_exact): Exact integer LLL (Cohen, A Course in Computational Algebraic Number Theory, Algorithm 2.6.3): the Gram–Schmidt quantities are tracked as EXACT integers (the sub-determinants `dᵢ` and the scaled coefficients `λᵢⱼ = dⱼ·μᵢⱼ`), with Bareiss-style exact division — no floating point (so no precision loss on high-dynamic-range lattices) and no rationals (so no coefficient blow-up). This is the trustworthy reduction the Boneh–Durfee independence diagnosis needs. - [fn lll_reduce_bigint_fp](https://docs.logicaffeine.com/logicaffeine_proof/lattice/fn.lll_reduce_bigint_fp): The L² lattice reduction (fpLLL): LLL with a BigFloat Gram–Schmidt — fast like floating point, but with `FP_PREC` bits of precision so it survives the high dynamic range of Coppersmith/Boneh–Durfee lattices where f64 fails, and without the determinant blow-up of the exact integer LLL. The basis stays exact integer; only the steering is in BigFloat, and swaps update the Gram–Schmidt incrementally (`O(n³)` overall rather than the `O(n⁵)` of recompute-on-swap). ## logicaffeine_proof::lemma_index `exact?` / `apply?` and premise selection: search over a NAMED, certified lemma library. - [struct LemmaIndex](https://docs.logicaffeine.com/logicaffeine_proof/lemma_index/struct.LemmaIndex): An index over a named lemma library. - [struct Suggestion](https://docs.logicaffeine.com/logicaffeine_proof/lemma_index/struct.Suggestion): A search result: which lemma, the suggested tactic text, the instantiation, and (for `apply?`) the antecedents still to prove. ## logicaffeine_proof::linalg Exact linear algebra over ℚ — the certified core of the LOGOS numerical stack. - [struct Certified](https://docs.logicaffeine.com/logicaffeine_proof/linalg/struct.Certified): A solve carrying its own certificate: the exact solution plus independently re-checked flags that `A·x = b` holds exactly and `det A ≠ 0`. This is what “prove, not just run” means for a solve. - [struct Lu](https://docs.logicaffeine.com/logicaffeine_proof/linalg/struct.Lu): An exact LU factorization `P·A = L·U`: `perm` is the row permutation (P), `l` is unit lower-triangular, `u` is upper-triangular. `None` iff singular. - [fn certify_solve](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.certify_solve): Solve and certify in one call. `None` iff singular. - [fn det](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.det): Exact determinant via forward elimination (product of pivots × permutation sign). - [fn identity](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.identity): The exact n×n identity matrix. - [fn inverse](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.inverse): Exact matrix inverse via Gauss–Jordan on `[A | I]`. `None` iff singular. - [fn is_inverse](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.is_inverse): Is `A·B == I` exactly? (independent re-check behind a certified inverse) - [fn lu](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.lu): Exact LU with partial (nonzero) pivoting. Every multiplier is an exact rational. - [fn lu_is_exact](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.lu_is_exact): Certify a factorization: is `P·A == L·U` exactly? (P·A is A with its rows permuted by `perm`.) - [fn matmul](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.matmul): Exact matrix product `A·B`. - [fn matvec](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.matvec): A·x over the rationals, computed exactly. - [fn rank](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.rank): Exact rank (works for rectangular matrices) via row reduction — the number of nonzero pivots. - [fn residual_is_zero](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.residual_is_zero): Is `A·x == b` exactly, component by component? The independent re-check behind a certified solve. - [fn solve](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.solve): Solve `A·x = b` exactly by Gauss–Jordan elimination with nonzero pivoting (n×n). Returns `None` iff `A` is singular. All arithmetic is exact — the answer `1/3` stays `1/3`. - [fn transpose](https://docs.logicaffeine.com/logicaffeine_proof/linalg/fn.transpose): Exact transpose. ## logicaffeine_proof::linalg_certify Kernel-certified linear algebra: turn an exact solve into a KERNEL-CHECKED PROOF TERM. - [struct SystemCert](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/struct.SystemCert): The complete certificate that a linear system `A·x = b` has a UNIQUE exact solution: the exact `x`, a kernel proof of `Aᵢ·x = bᵢ` for every row, and a kernel proof that `det A ≠ 0` (so the solution is unique, not merely one of many). Every term is re-checked by the kernel. This is the full “prove, not just run” object for a linear system. `None` iff singular or past the i64 width. - [fn certify_system](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.certify_system): Solve and produce the complete unique-solution certificate. - [fn prove_dot](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.prove_dot): Prove the dot-product identity `Σₖ psₖ·qsₖ = r` as ONE kernel-checked term (type `Eq Int lhs rhs`). Clears denominators to `rd·Σₖ (Pnₖ·Qnₖ) = Dp·Dq·rn` — structure preserved — proves it with the untrusted oracle, then RE-CHECKS with the kernel. `None` if false or past i64. This one identity underlies every certificate below: a solve is a row·x = b, a factorization entry is Lrow·Ucol = (PA)ᵢⱼ, an inverse entry is Arow·(A⁻¹col) = Iᵢⱼ. - [fn prove_inverse](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.prove_inverse): Invert `A` and PROVE it in the kernel: every entry of `A·A⁻¹ = I` is a dot-product proof `Aᵢ·(A⁻¹)ⱼ = Iᵢⱼ` (the off-diagonal `= 0` identities are proven too). `None` iff singular / past i64. - [fn prove_lu](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.prove_lu): Factor `A` and PROVE the factorization in the kernel: every entry of `P·A = L·U` is a dot-product proof `Lᵢ·Uⱼ = (PA)ᵢⱼ`. Returns the exact factorization and an n×n grid of kernel-checked terms. - [fn prove_nonzero](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.prove_nonzero): Prove `r ≠ 0` in the kernel by EXHIBITING its inverse: a kernel-checked proof of `r·(1/r) = 1`. A value with a multiplicative inverse is nonzero, so this certifies nonsingularity when applied to a determinant. `None` iff `r == 0` — correctly unprovable, since `0` has no inverse. - [fn prove_solution](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.prove_solution): Prove `A·x = b` for a GIVEN candidate `x`, one kernel-checked proof term per row (each is the row dot-product identity `Aᵢ·x = bᵢ`). `None` if any row is false (fail-closed) or past i64. - [fn prove_solve](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.prove_solve): Solve `A·x = b` exactly and hand back the exact `x` together with a kernel-checked proof that it solves the system (one proof term per row). `None` iff singular or beyond the i64 oracle width. - [fn ring_context](https://docs.logicaffeine.com/logicaffeine_proof/linalg_certify/fn.ring_context): A kernel context of its own carrying the ring/field/order axioms the oracle proves against: a copy-on-write clone of the standard library’s one registration. ## logicaffeine_proof::linarith_solve The decision core for linear integer arithmetic: Fourier-Motzkin elimination that tracks the non-negative combination it eliminates with, so an unsatisfiable system yields its Farkas certificate — the multipliers `λᵢ ≥ 0` on the original constraints such that `Σ λᵢ·constraintᵢ` is a positive constant `≤ 0` (a contradiction). The proof engine reconstructs a kernel proof from those multipliers via `le_mul_nonneg`/`le_add_mono` + the Bool no-confusion discriminator. Pure and self-contained — no kernel, no certificates here. - [struct LinExpr](https://docs.logicaffeine.com/logicaffeine_proof/linarith_solve/struct.LinExpr): A linear expression `Σ cⱼ·xⱼ + constant` over the integers (zero coefficients pruned, so equality is canonical). - [fn combine](https://docs.logicaffeine.com/logicaffeine_proof/linarith_solve/fn.combine): `Σ multipliers[i]·constraints[i]`. For a valid Farkas certificate this is a bare positive constant (the variables cancel) — that constant is the `d` in the reconstructed contradiction `0 ≤ -d`. - [fn find_farkas](https://docs.logicaffeine.com/logicaffeine_proof/linarith_solve/fn.find_farkas): Given constraints `cᵢ ≤ 0`, find a non-negative integer combination `Σ λᵢ·cᵢ = (positive constant) ≤ 0` — a Farkas refutation. Returns the multipliers `λᵢ`, or `None` if the system is satisfiable over ℚ (so no rational Farkas certificate exists). - [fn parse_lin](https://docs.logicaffeine.com/logicaffeine_proof/linarith_solve/fn.parse_lin): Parse a `ProofTerm` into a linear expression, or `None` if it is non-linear (e.g. `mul` of two non-constants). Numeric constants are literals; other names are variables; `add`/`sub`/`mul` build the form. ## logicaffeine_proof::lll Satisfiability from sparsity — the Lovász Local Lemma certificate and its constructive Moser–Tardos witness. The lower bookend to the first-moment bound. - [struct LllSatCert](https://docs.logicaffeine.com/logicaffeine_proof/lll/struct.LllSatCert): A re-checkable SAT certificate from the Lovász Local Lemma: the minimum clause width `w_min` and the maximum dependency degree `d` that together satisfy `e · 2^{−w_min} · (d+1) ≤ 1`. - [fn lll_certifies_sat](https://docs.logicaffeine.com/logicaffeine_proof/lll/fn.lll_certifies_sat): Certify satisfiability from sparsity via the symmetric LLL. Returns the witnessing degrees when `e · 2^{−w_min} · (d+1) ≤ 1`; otherwise `None` (the condition is sufficient, not necessary — `None` means “this certificate does not apply”, never “UNSAT”). An empty clause set is vacuously SAT; a set containing an empty clause can never be certified (it is UNSAT). - [fn lll_dependency_degree](https://docs.logicaffeine.com/logicaffeine_proof/lll/fn.lll_dependency_degree): The LLL dependency degree: the maximum, over all clauses, of the number of other clauses that share at least one variable with it. Clauses over disjoint variable sets are independent events and do not count toward the degree. - [fn moser_tardos_witness](https://docs.logicaffeine.com/logicaffeine_proof/lll/fn.moser_tardos_witness): Constructively find a satisfying assignment by Moser–Tardos resampling: start from a random assignment and, while some clause is violated, resample the variables of one violated clause. Under the LLL condition this terminates in expected `O(m)` resamples; the `max_resamples` cap is a safety net (only reachable when the condition does not hold). Returns a model, or `None` if the cap is hit. ## logicaffeine_proof::lrat LRAT refutations at scale: hint chains found by watched-literal propagation, trimmed to the clauses a refutation uses, and replayed by a checker that trusts nothing the search did. - [struct Lrat](https://docs.logicaffeine.com/logicaffeine_proof/lrat/struct.Lrat): An LRAT refutation of a formula whose clauses carry the ids `1..=n`: additions in increasing id order, ending in the empty clause. - [struct LratStep](https://docs.logicaffeine.com/logicaffeine_proof/lrat/struct.LratStep): One addition of an LRAT refutation: under the clause’s negation each hinted clause, in order, is unit, until the last conflicts. - [fn check](https://docs.logicaffeine.com/logicaffeine_proof/lrat/fn.check): Whether `proof` refutes `original`: every step’s id exceeds the one before it (and the formula’s), every hint names a clause already present, every step’s hints replay (each unit under the step’s negation, the last a conflict), and a step derives the empty clause. Every literal must lie below `num_vars`. - [fn check_derivation](https://docs.logicaffeine.com/logicaffeine_proof/lrat/fn.check_derivation): Whether `proof` derives every clause of `claims` from `original`: every step’s id exceeds the one before it (and the formula’s), every hint names a clause already present, every step’s hints replay, and each claim, its literals in any order, is the clause of a step or of the formula. Every literal must lie below `num_vars`. - [fn derivation](https://docs.logicaffeine.com/logicaffeine_proof/lrat/fn.derivation): The trimmed LRAT derivation of the clauses of `log` that `targets` names (by index) from `original`, every clause of `log` RUP from the formula and the clauses before it: a step for each target and for each log clause a step it leans on needs, in log order, the `j`-th log clause numbered after the formula’s. `None` when a target, or a clause one needs, is not RUP in its place, or a target names no log clause. - [fn refutation](https://docs.logicaffeine.com/logicaffeine_proof/lrat/fn.refutation): The trimmed LRAT refutation of `original` that `learned` (each clause RUP from the formula and the clauses before it) carries to the empty clause, or `None` when the empty clause is not RUP from them all or a learned clause the refutation needs is not RUP in its place: the `derivation` of the empty clause, after the learned clauses. ## logicaffeine_proof::lyapunov Lyapunov-function synthesis — don’t search for the proof, discover the measure that collapses the problem, and let the proof fall out as a corollary. - [struct CardinalitySeams](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/struct.CardinalitySeams): The cardinality / parity symmetry seams. Each recovered cardinality group is fully symmetric — its members are interchangeable (`S_m` preserves “at most `k` of them true”). In a COUPLED instance only some of those swaps survive as MODEL-SET symmetries; the parity coupling blocks the rest. This partitions the candidate interchangeable pairs into `joint` (a transposition that preserves the model set — a free symmetry to break) and `seams` (a transposition the parity genuinely tears). The check is SEMANTIC (parity SPAN + non-parity clauses via `SemanticSymmetry`), so it recognizes the affine parity symmetry a clause-automorphism test misses. The joint swaps generate the model-preserving symmetry at the seam. - [struct CollapsingMeasure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/struct.CollapsingMeasure): A discovered collapsing potential: the formula’s variables read as an `items × bins` grid (`var(i, b) = i*bins + b`) under which item-permutations are symmetries — so the formula is a covering / pigeonhole problem and `items > bins` makes it unsatisfiable. - [struct CoveringMeasure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/struct.CoveringMeasure): A covering Lyapunov measure: `items` into `bins` (`var(i,b) = i*bins + b`) with item-swap witnesses. ONE measure type that instantiates the theorem for every covering family — PHP (`items = n, bins = n-1`), clique-coloring (`items = n, bins = k`), and any other generalized pigeonhole. The “lift”: the family is data, the measure is uniform. - [struct LyapunovCertificate](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/struct.LyapunovCertificate): A machine-checked certificate that a refutation’s trajectory carries a valid Lyapunov function, with the four dynamical-systems axioms verified explicitly and the resulting complexity bound. - [struct PartialCoveringMeasure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/struct.PartialCoveringMeasure): A covering measure restricted to the absolute rounds `[lo, hi]` — it breaks only those covering levels, leaving a residual for a later stage. The tool that makes COMPOSITION non-trivial: a stage that genuinely hands a smaller problem to the next. - [struct SymmetryTheory](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/struct.SymmetryTheory): A live symmetry theory for `crate::cdcl::Solver::solve_with` — DYNAMIC lex-leader propagation over the whole symmetry group. Each element is an AFFINE map `α` (a model-set automorphism) given as a per-output spec `α(x)[i] = ⊕_{s∈xset_i} x_s ⊕ b_i`; permutations are the special case where every `xset` is a single variable. During search it enforces `x ≤_lex α(x)`: walking positions while the prefix stays equal, computing `α(x)[i]` from the trail (an XOR of the support), then at the frontier forcing `x_i = 0` when `α(x)[i] = 0`, forcing the last free support bit to make `α(x)[i] = 1` when `x_i = 1`, or conflicting — AUX-FREE, on the shared trail, fused alongside the parity and cardinality theories. Sound: the orbit’s global lex-minimum satisfies `x ≤_lex α(x)` for EVERY `α`, so the whole group’s predicate keeps exactly one representative per orbit (equisatisfiable), and every reason clause (prefix + support witnesses) is implied by it. - [enum AutoCollapse](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/enum.AutoCollapse): The result of the unified engine: which physics collapsed the formula, with its checkable artifact. - [const MAX_RECOVERED_CARDINALITY](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/constant.MAX_RECOVERED_CARDINALITY): The widest core a fused solve recovers automatically: at-most-`k` groups up to this `k`. Beyond it, call `recover_at_most_k` directly — but the `C(group, k)` scan cost (budget-bounded) and the diminishing yield of ever-wider exclusion cliques make 4 (5-ary clauses) the default ceiling. - [trait LyapunovMeasure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/trait.LyapunovMeasure): The hypothesis of the ⟸ theorem: a Lyapunov measure that generates certified descent steps for a formula, independent of any particular family. - [fn affine_parity_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.affine_parity_symmetries): Detect affine (shear) symmetries of a fused instance that preserve the model set — the affine parity symmetries a variable-permutation break structurally cannot express (an image bit becomes an XOR of two variables). For a variable `i` that appears in NO non-parity (cardinality / residual) clause and any `j ≠ i`, the shear `x_i ↦ x_i ⊕ x_j` moves only position `i`, so it leaves the cardinality/residual intact; it is a model-set symmetry iff it maps the parity SOLUTION SPACE to itself (checked on the space’s affine spanning set — particular ⊕ each kernel basis vector). Each valid shear is returned as an SBP affine-map spec (identity except output `i = ⊕{i,j}`) for `crate::sym_break::affine_lex_leader_sbp`. Gated to `num_vars ≤ 64`. - [fn all_transposition_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.all_transposition_symmetries): Every single-transposition model-set symmetry — every variable swap that preserves the model set (`SemanticSymmetry`): parity-variable permutations, cardinality permutations, and residual-clause permutations alike. Broadens the wreath-tower (cardinality-only) symmetry to the FULL permutation symmetry of the whole instance — in particular the permutations of parity-only variables neither the cardinality detector nor the affine shear detector finds. Budget-bounded (`n ≤ 64`, `C(n,2)` checks). - [fn auto_collapse](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.auto_collapse): The unified, structure-recognizing engine. Given only opaque clauses, decide WHICH collapse physics applies — covering symmetry or parity — and produce the corresponding Lyapunov-certified artifact. One engine; the structure selects the mechanism. Sound and fail-closed on both paths. - [fn cardinality_collapse](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.cardinality_collapse) - [fn cardinality_parity_seams](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.cardinality_parity_seams): Compute the `CardinalitySeams` of a fused instance: for every pair of variables interchangeable in some recovered cardinality group, test whether swapping them is a model-set symmetry (`SemanticSymmetry`) — joint if so, a seam if not. Pair-budget-bounded (a partial joint set still yields sound symmetry breaks). - [fn cardinality_symmetry_break](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.cardinality_symmetry_break): Break the joint cardinality/parity symmetry: union the joint swaps into interchangeable components (a component is fully symmetric — the group generated by its transpositions is `S`, every element an automorphism), then order each component’s variables into a descending chain with `vᵢ ≥ vᵢ₊₁` clauses `(vᵢ ∨ ¬vᵢ₊₁)`. A lex-leader: equisatisfiable (every orbit keeps its ordered representative), so it shrinks the fused search without changing the verdict. Returns the extra clauses (empty if no joint symmetry). - [fn cardinality_symmetry_generators](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.cardinality_symmetry_generators): The generators of the joint parity/cardinality symmetry, UP THE WREATH CHAIN. Two levels: - [fn compose_collapses](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.compose_collapses): Compose collapses — the `Poly` wiring diagram on certified descents. Each stage’s descent runs on the residual database of the previous; the potentials are banded (earlier stages occupy the higher rank band) so the composite strictly descends across every stage boundary; the whole closes by resolution. The result is ONE refutation carrying ONE combined Lyapunov certificate — two (or more) collapses wired into a single descent. Fail-closed: each step is PR-self-checked. - [fn covering_collapse](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.covering_collapse): Drive the steered Heule descent over a discovered `items × bins` covering layout: `bins + 1` items are a tight pigeonhole, so force them out of the bins one at a time, each `¬var(i, bin)` certified by “swap item `i` with the last active item.” Returns the ranked refutation; every step is PR-self-checked, so a layout that is not really a covering problem simply fails to refute. - [fn cutting_planes_lyapunov](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.cutting_planes_lyapunov): The Lyapunov function for the cardinality / cutting-planes collapse — the THIRD physics. The Cook–Coullard–Turán refutation of PHP sums `2n-1` pseudo-Boolean constraints; each addition cancels a literal against its negation and tightens the accumulated constraint toward the infeasible `0 ≥ 1`. The potential is the number of constraints still to combine, descending to `0` exactly as the contradiction is exposed. - [fn extract_xor](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.extract_xor): Recover the XOR (parity) constraints latent in a CNF: a constraint `x₁⊕…⊕x_k = b` is encoded by exactly the `2^(k-1)` clauses over `{x₁,…,x_k}` whose negated-literal count has one fixed parity. We group clauses by their variable set and emit an `XorEquation` for each group that is exactly such a gadget. Sound: every emitted equation is logically equivalent to a clause group present in the formula, so a refutation of the extracted (sub)system implies the formula is UNSAT. - [fn fused_parity_cardinality_decide](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.fused_parity_cardinality_decide): The fused parity + cardinality decision. When a formula carries BOTH a GF(2) linear substructure (recovered XOR equations via `extract_xor`) AND an at-most-one cardinality substructure (via `recover_at_most_one`), decide it with the two live theories reasoning TOGETHER on one trail — Gaussian elimination for the parity, cardinality propagation for the counting — the structural attack on minimal-disagreement parity that neither alone cracks. Returns `Some(is_sat)`, or `None` when either substructure is absent (so a caller falls through to other routes). Sound: the original clauses are solved (Boolean-complete), the theories return only formula-entailed clauses, and a SAT model is re-checked against the clauses (fail-closed). Uses the stateless `crate::xor_engine::XorEngine` (not `IncXor`, whose value-blind trail-sync is unsafe without a backing clausal XOR encoding). - [fn fused_permutation_generators](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.fused_permutation_generators): The permutation generators for the DYNAMIC symmetry theory: the wreath-tower cardinality permutations plus every transposition symmetry of the whole instance. - [fn fused_symmetry_group](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.fused_symmetry_group) - [fn gaussian_lyapunov](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.gaussian_lyapunov): The Lyapunov function for the algebraic collapse — Gaussian elimination over GF(2). The potential is the number of pivots still to be found in the unsolved linear system; each elimination step strictly reduces it, and the trajectory reaches the goal exactly when an inconsistent row `0 = 1` is exposed. Returns the descending potential and whether the goal (contradiction) was reached. - [fn lyapunov_of_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.lyapunov_of_symmetry): Extract and verify the Lyapunov certificate of a symmetry refutation: its rank annotation is the potential (“active items remaining”), and the refutation closing is the goal-reaching axiom. - [fn proof_from_measure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.proof_from_measure): The constructive proof of the ⟸ theorem. Drive the measure’s descent from `L` down to `0`, self-checking every step (fail-closed), then close with unit propagation. Returns a ranked refutation whose descent has `≤ L·w` steps — read its certificate with `crate::complexity::RankedRefutation::certify`. - [fn proof_induced_measure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.proof_induced_measure): The ⟹ direction of the characterization: any checkable refutation of `n_steps` steps induces a Lyapunov measure — rank the steps in descending order. The induced trajectory is a valid Lyapunov function of size `n_steps`, so the minimum measure cost `μ*(F) ≤ (min proof size)`. - [fn recover_at_most_k](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.recover_at_most_k): Recover the at-most-`k` cardinality substructure over arbitrary LITERALS — the generalisation of `recover_at_most_one` to WIDER and MIXED-POLARITY counting cores (the ternary at-most-two cores of parity-learning instances, and — via negation — at-least-`k`). Work in literal codes (`2·var + sign`, negation flips the low bit). A width-`(k+1)` clause `ℓ₀ ∨ … ∨ ℓ_k` is violated only when all of `{¬ℓ₀,…,¬ℓ_k}` are true, so it FORBIDS that literal set; a set `S` of literals (distinct variables) is an at-most-`k` group iff EVERY `(k+1)`-subset of `S` is some clause’s forbidden set. Greedy maximal extension from each forbidden seed — a literal joins `S` only when every `k`-subset of `S` together with it is forbidden, so the invariant keeps every `(k+1)`-subset forbidden and `at_most(S, k)` genuinely implied by clauses present (sound to fuse). A clause `[¬a,¬b,¬c]` ⇒ at-most-2 of `{a,b,c}`; the three clauses `[a,b],[a,c],[b,c]` ⇒ at-most-1 of `{¬a,¬b,¬c}` = at-least-2 of `{a,b,c}`. `k = 1` over all-negative binary clauses reproduces `recover_at_most_one`. - [fn recover_at_most_one](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.recover_at_most_one): Recover the at-most-one cardinality substructure from arbitrary clauses — the substructure twin of `discover_covering`, which requires the WHOLE formula to be a covering (so a single XOR gadget makes it decline). Binary all-negative clauses `¬a ∨ ¬b` are at-most-one edges; this returns an `at_most(group, 1)` PB constraint per maximal exclusion clique of size ≥ 2, IGNORING every other clause. Each emitted group is a verified FULL clique (every pair has its exclusion clause present), so its `≤ 1` is implied by clauses in the formula — sound to feed a solver alongside a recovered parity system (the par32 fusion). - [fn recover_cardinality_constraints](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.recover_cardinality_constraints): The third physics, made automatic: cardinality / cutting-planes collapse of a discovered covering. When the formula is a bipartite covering with more items than bins, summing the “item ≥ 1” rows against the “bin ≤ 1” columns telescopes to `0 ≥ (items − bins) > 0` — the Cook–Coullard–Turán refutation, in the cutting-planes proof system. Sound: every summed constraint is implied by clauses present in the formula (full-clique-checked), so a contradiction proves UNSAT. Returns `(trajectory, reached_goal, constraints)` — the GF(2)-analogue Lyapunov descent (constraints remaining to combine). Crucially this needs no symmetry, so it collapses asymmetric coverings the geometric route cannot. Recover the cardinality structure of an opaque CNF as PB constraints — a `≥ 1` clause per at-least-one row and a `≤ 1` per at-most-one clique (the cardinality the pairwise encoding loses). The clause-level recognizer (the `extract_xor` analogue for counting) that feeds BOTH the static `cardinality_collapse` cut and the live `crate::pseudo_boolean::CardinalityTheory`. `None` when the formula is not a clean covering, so callers fall through. Each returned constraint is implied by clauses present in the formula (the columns are full-clique-checked by `discover_covering`), so feeding them to a solver is sound. - [fn recover_cardinality_substructure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.recover_cardinality_substructure): Recover the cardinality substructure a fused solve consumes: every at-most-`k` group over arbitrary literals, `k = 1 … ``MAX_RECOVERED_CARDINALITY` — pairwise, ternary, quaternary, … exclusion cliques of any polarity, so at-most-`k`, at-least-`k` (the negated cliques), and mixed counting cores all flow into the fused theory. Each `recover_at_most_k` returns immediately when the formula has no width-`(k+1)` clause of the right shape, so widening is free on instances that lack those cores. - [fn solve_by_measure_synthesis](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.solve_by_measure_synthesis): The whole inversion: discover the Lyapunov function, then let the proof fall out. Search the covering-layout class; for each candidate whose item-swap is a symmetry, run the steered collapse; return the first that yields a checking refutation, paired with the measure that drove it. `None` is a bounded impossibility — no covering-symmetry collapse exists for this formula. - [fn synthesize_measure](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.synthesize_measure): Search the bounded class of covering layouts for one whose item-swap is a genuine symmetry — a cheap pre-filter (one automorphism check per candidate factorization). Returns the first such measure in the `items > bins` (unsatisfiable) direction, or `None`. - [fn verify_lyapunov](https://docs.logicaffeine.com/logicaffeine_proof/lyapunov/fn.verify_lyapunov): Verify the four Lyapunov axioms over a potential trajectory and return the certificate, or `None` if any axiom fails. (1) bounded below — `u64` is `≥ 0` by type; (2) monotone non-increasing; (3) strict descent across the level set; (4) reaches the minimum at the goal. A trajectory that stalls (a level recurs) or never closes is not a Lyapunov function and certifies nothing. ## logicaffeine_proof::macaulay Monomials and the Macaulay matrix — the combinatorial skeleton of the XL algorithm. - [fn degree](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/fn.degree): The degree of a monomial (its total number of variable factors). - [fn monomials_of_degree](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/fn.monomials_of_degree): Every monomial in `n` variables of degree exactly `deg`, listed with variable indices in nondecreasing order. Strictly increasing (squarefree) when `multilinear`. - [fn monomials_up_to_degree](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/fn.monomials_up_to_degree): Every monomial in `n` variables of degree `0..=max_deg`. The constant `1` is always first (index `0`), which the XL solver relies on to read off constant terms. - [fn mul](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/fn.mul): The product of two monomials. When `multilinear`, repeated variables collapse (`x² = x`), the correct rule for GF(2); otherwise exponents accumulate. - [fn one](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/fn.one): The constant monomial `1`. - [type Monomial](https://docs.logicaffeine.com/logicaffeine_proof/macaulay/type.Monomial): A monomial: the sorted multiset of variable indices it contains. `Vec::new()` is `1`. ## logicaffeine_proof::matching Certified bipartite-matching infeasibility — the polynomial reasoner for pigeonhole-shaped problems that are exponential for resolution (and therefore for any CDCL SAT solver, ours included). - [struct CapHallWitness](https://docs.logicaffeine.com/logicaffeine_proof/matching/struct.CapHallWitness): A capacitated Hall certificate: the items in `S` can only reach the slots in `slots`, whose total capacity is strictly less than `|S|` — so they cannot all be placed. Re-checkable via `is_cap_hall_witness`. - [struct HallWitness](https://docs.logicaffeine.com/logicaffeine_proof/matching/struct.HallWitness): A Hall-theorem certificate of infeasibility: `items` (the set `S`) can collectively reach only the slots in `slots` (a superset of `N(S)`), and `slots.len() < items.len()` — so by pigeonhole the items cannot be placed one-per-slot. Independently checkable via `is_hall_witness`. - [enum CapMatchOutcome](https://docs.logicaffeine.com/logicaffeine_proof/matching/enum.CapMatchOutcome): The outcome of a capacitated assignment: each slot `s` holds at most `capacities[s]` items. - [enum MatchOutcome](https://docs.logicaffeine.com/logicaffeine_proof/matching/enum.MatchOutcome): The outcome of a bipartite “each slot holds at most one item” feasibility check. - [fn assign_or_hall](https://docs.logicaffeine.com/logicaffeine_proof/matching/fn.assign_or_hall): Decide whether every item can be assigned a distinct slot, where `adj[i]` lists the slots item `i` may use and slots range over `0..num_slots`. Returns a perfect assignment or a certified Hall witness. Finds a maximum matching with Hopcroft–Karp (`O(E·√V)` — many shortest vertex-disjoint augmenting paths per phase, far faster than Kuhn’s `O(V·E)` as instances grow), then — on failure — the König alternating-reachability construction extracts the deficient set. - [fn assign_or_hall_capacitated](https://docs.logicaffeine.com/logicaffeine_proof/matching/fn.assign_or_hall_capacitated): Decide whether every item can be assigned a slot when slot `s` holds at most `capacities[s]` items (a b-matching / resource-allocation feasibility — e.g. traffic movements sharing capacity-limited green windows). Reduces to plain matching by splitting each slot into that many interchangeable copies, then maps the result (and any Hall witness) back to original slots. - [fn is_cap_hall_witness](https://docs.logicaffeine.com/logicaffeine_proof/matching/fn.is_cap_hall_witness): Re-check a capacitated Hall witness: every item in `S` reaches only slots in `T`, and the total capacity of `T` is below `|S|`. - [fn is_hall_witness](https://docs.logicaffeine.com/logicaffeine_proof/matching/fn.is_hall_witness): Independently re-check a Hall witness: every item in `S` reaches only slots in `T`, and `|T| < |S|`. This is the certificate verifier — a trusted, solver-free check that the claimed infeasibility is genuine. - [fn is_valid_assignment](https://docs.logicaffeine.com/logicaffeine_proof/matching/fn.is_valid_assignment): Re-check a feasible assignment: one distinct slot per item, each within that item’s allowed set. ## logicaffeine_proof::min_cost_flow Minimum-cost flow, exact and certified: the dual of every scheduling and retiming problem whose constraints are differences of two variables, which is how a register cut of least area at a target clock is found. - [struct Arc](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/struct.Arc): An arc: `capacity` units at most (`None` for no bound), at `cost` a unit. - [enum FlowError](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/enum.FlowError): Why a problem was not solved. - [enum Solution](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/enum.Solution): A problem’s answer, with its certificate. - [const COST_LIMIT](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/constant.COST_LIMIT): The bound on an arc’s cost. - [const FLOW_LIMIT](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/constant.FLOW_LIMIT): The bound on an arc’s capacity and on the supplies’ total size. - [fn check](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/fn.check): Whether `solution` is the problem’s answer, by its certificate alone. - [fn min_cost_flow](https://docs.logicaffeine.com/logicaffeine_proof/min_cost_flow/fn.min_cost_flow): The least-cost flow meeting `supply` (positive where flow starts, negative where it ends) over `arcs`. ## logicaffeine_proof::modm Linear algebra over `ℤ/m` for composite `m`, by the Chinese Remainder Theorem — the multiplicative symmetry break. A system `Σ aᵢ·xᵢ ≡ c (mod m)` over a squarefree modulus `m = p₁·…·p_t` factors, through the ring isomorphism `ℤ/m ≅ GF(p₁) × … × GF(p_t)`, into one independent system over each prime field — each decided by `crate::modp::solve` — and the per-field solutions are recombined by CRT. The factorization of the modulus is the symmetry that splits the problem; the prime fields are the irreducible pieces: - [struct SolutionSpaceM](https://docs.logicaffeine.com/logicaffeine_proof/modm/struct.SolutionSpaceM): The complete solution space of a `ℤ/pᵏ` linear system, in symmetry-broken form: a particular solution plus a generating set of the kernel submodule (each generator is a column of the Smith transform `V` scaled by its pivot’s freedom `q/gcd(dₜ,q)`). The prime-power analogue of `crate::modp::SolutionSpaceP` over a local ring — and the substrate of the scalable forced/linked break: a variable the kernel never moves is forced. - [enum AllowedOutcome](https://docs.logicaffeine.com/logicaffeine_proof/modm/enum.AllowedOutcome): The per-variable allowed-value congruence of a `ℤ/m` system, for any composite `m`. By CRT over the prime-power components, each variable’s solution-projection is a coset `x_g ≡ residue (mod modulus)` — the tightest congruence the system forces on it. Generalizes forcing: `modulus = m` is a single value (fully forced), `1 < modulus < m` is partial (confined to a value-subset), `modulus = 1` is free. Within each prime-power component the coset modulus is `gcd(p^k, kernel column at g)` from `solve_space_prime_power`; the components recombine by CRT. `Inconsistent` if any component is. - [enum ForcedM](https://docs.logicaffeine.com/logicaffeine_proof/modm/enum.ForcedM): The forced-value structure of a `ℤ/m` system over a squarefree `m`. - [enum ModmOutcome](https://docs.logicaffeine.com/logicaffeine_proof/modm/enum.ModmOutcome): The outcome of deciding a linear system over `ℤ/m`. - [enum PrimePowerSpace](https://docs.logicaffeine.com/logicaffeine_proof/modm/enum.PrimePowerSpace): The outcome of `solve_space_prime_power`. - [fn allowed_residues](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.allowed_residues): See `AllowedOutcome`. `None` only on Smith overflow. - [fn cycle_system](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.cycle_system): The scalable composite obstruction: the `n`-cycle of differences `xᵢ − x_{i+1} ≡ 1 (mod m)`, inconsistent exactly when `m ∤ n` (summing telescopes the left to `0`, the right to `n`). The coefficient `−1` is written `m − 1`. Reuses `crate::modp::cycle_system`’s shape across the field. - [fn forced_values_prime_power](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.forced_values_prime_power): Which variables a `ℤ/m` system forces, for any composite `m` — by CRT over its prime-power components (`ℤ/m ≅ ∏ ℤ/pᵢ^{kᵢ}`), each solved scalably by Smith normal form (`solve_space_prime_power`): a variable is forced mod `m` iff its kernel never moves it in every component, and the value is the CRT of the residues. This is the Smith-form generalization that replaces the old bounded brute force — no size cap; `None` only on Smith overflow. `Inconsistent` when any component is. - [fn forced_values_squarefree](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.forced_values_squarefree): Which variables a squarefree `ℤ/m` system forces to a single value, by CRT of the `GF(pᵢ)` solution spaces (`ℤ/m ≅ ∏ GF(pᵢ)`): a variable is forced mod `m` iff it is forced mod every prime factor (`crate::modp::solve_space` — its kernel never moves it), and the value is the CRT of those residues. `None` if `m` is not squarefree (the prime-power case needs Smith normal form, not handled here). This is the substrate of the composite affine SAT-side break. - [fn is_refutation](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.is_refutation): Re-check a refutation over `ℤ/modulus`: the chosen combination of equations has every variable coefficient `≡ 0` and a nonzero right-hand side mod `modulus` — a solver-free certificate that the system is inconsistent over that quotient ring (and hence over any `ℤ/m` with `modulus | m`). - [fn prime_power_factorize](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.prime_power_factorize): The prime-power factorization of `m` (`m = ∏ pᵢ^{kᵢ}`), or `None` if `m < 2`. - [fn satisfies](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.satisfies): Re-check a satisfying assignment over `ℤ/m`: every congruence holds mod `m`. - [fn solve](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.solve): Decide a linear system over `ℤ/m` for any `m ≥ 2`, closing every composite modulus. By CRT, `ℤ/m ≅ ∏ ℤ/pᵢ^{kᵢ}`: solve each prime-power component (`solve_prime_power`) and recombine the residues. Consistent mod `m` ⟺ consistent over every prime-power factor; the first inconsistent factor is the witness (and certifies UNSAT mod `m`, since that factor divides `m`). Returns `None` only if `m < 2`, or a component is too large / overflows the integer Smith reduction. - [fn solve_prime_power](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.solve_prime_power): Decide a linear system over the residue ring `ℤ/pᵏ`. For `k = 1` this is the prime field, handed to the proven `crate::modp::solve`. For `k ≥ 2` the ring has zero divisors, so we diagonalize over the integers — `U·A·V = D` with `U, V` unimodular (Smith-style: gcd row/column reduction) — after which each `dₜ·yₜ ≡ (U·b)ₜ (mod pᵏ)` is an independent 1-D congruence, solvable iff `gcd(dₜ, pᵏ) ∣ (U·b)ₜ`. `U` yields both the satisfying assignment (`x = V·y`) and, on failure, the re-checkable refutation (a row of `U`, scaled to annihilate the coefficients mod `pᵏ`). Returns `None` only if the integer entries would exceed `GROWTH_CAP`. - [fn solve_space_prime_power](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.solve_space_prime_power): Solve a `ℤ/pᵏ` system for its full solution space via Smith normal form `U·A·V = D` — the scalable analogue of `crate::modp::solve_space` over a prime-power ring (where `p` is a zero-divisor, so field Gaussian fails). Returns the particular solution plus the kernel generators (so a variable the kernel never moves is forced), or `Inconsistent`. `None` only when the integer Smith reduction overflows `GROWTH_CAP`. `k = 1` delegates to the prime-field solver. - [fn solve_squarefree](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.solve_squarefree): Decide a linear system over `ℤ/m` for squarefree `m`, via CRT over the prime fields. Returns `None` only when `m` is not squarefree (the prime-power ring is a separate rung). The first prime factor whose system is inconsistent is reported as the witness — by CRT, the whole composite system is then inconsistent. - [fn squarefree_primes](https://docs.logicaffeine.com/logicaffeine_proof/modm/fn.squarefree_primes): The distinct prime factors of `m`, in increasing order — or `None` if `m < 2` or `m` is not squarefree (some `p² | m`). Squarefreeness is exactly the condition under which `ℤ/m` is a product of fields, so the CRT-over-prime-fields decision procedure below is complete. ## logicaffeine_proof::modp Linear algebra over `GF(p)` — the mod-`p` generalization of the GF(2) parity cut (`crate::xorsat`). - [struct ModpEquation](https://docs.logicaffeine.com/logicaffeine_proof/modp/struct.ModpEquation): A congruence `Σ (a·x) ≡ rhs (mod p)`. Coefficients and `rhs` are reduced mod `p`. `p` must be prime (so every nonzero element is invertible, via Fermat). - [struct ModpRecovery](https://docs.logicaffeine.com/logicaffeine_proof/modp/struct.ModpRecovery): A mod-`m` linear system recovered from an opaque Boolean CNF: the one-hot groups (each a `ℤ/m` variable, with the boolean var ids listed in value order) plus the congruences fitted to the forbidden-combination clauses. The recovered system is equisatisfiable to the source CNF, so the modular verdict carries back — over the prime field `solve` when `modulus` is prime, over the composite ring `crate::modm::solve` otherwise. See `recover_from_cnf`. - [struct SolutionSpaceP](https://docs.logicaffeine.com/logicaffeine_proof/modp/struct.SolutionSpaceP): The complete solution space of a `GF(p)` linear system `A x = b`, in symmetry-broken form: one particular solution `x₀` plus a basis of the kernel (null space). Every solution is `x₀ +` a `GF(p)` combination of the kernel basis, so all `p^{n−rank}` solutions are generated from this compressed witness. The kernel is the translation symmetry of the solution coset — the `GF(p)` analogue of `crate::gf2::SolutionSpace`, and the substrate of the affine SAT-side break: a variable the kernel never moves is forced to a single value. - [enum ModpOutcome](https://docs.logicaffeine.com/logicaffeine_proof/modp/enum.ModpOutcome): The outcome of solving a mod-`p` linear system. - [fn cycle_system](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.cycle_system): The canonical scalable mod-`p` obstruction: a cycle of differences `xᵢ − x_{i+1} ≡ 1 (mod p)` around an `n`-cycle. Summing all `n` equations telescopes the left side to `0` and the right to `n`, so the system is inconsistent exactly when `n` is not a multiple of `p` — the mod-`p` counting fact. For even `n` with `p > 2 ∤ n` it is satisfiable over `GF(2)` yet refuted over `GF(p)`: a family the parity cut cannot see. (`x − y` is written `x + (p−1)y`.) - [fn gl_order_p](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.gl_order_p): `|GL(n,p)|` over `GF(p)` via the orbit–stabilizer (ordered-basis) factorization `Π_{i=0}^{n-1}(pⁿ − pⁱ)`. `GL(n,p)` acts simply transitively on ordered bases of `GF(p)ⁿ`, so each factor `pⁿ − pⁱ` counts the vectors outside the i-dimensional span built so far — the same symmetry break as over `GF(2)`, now across the field. The `p = 2` case is `gf2::gl_order`. - [fn invertibility_density_p](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.invertibility_density_p): The invertibility density over `GF(p)`: `Π_{j=1}^n (1 − p⁻ʲ) = |GL(n,p)| / p^{n²}`. As the field grows the density → 1 (fewer linear collisions); `p = 2` is the densest-collision regime, the smallest constant `φ(½) ≈ 0.28879`. - [fn is_invertible_modp](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.is_invertible_modp): Is an `n×n` matrix over `GF(p)` invertible? Gaussian elimination with modular pivots: full rank `n`. `p` must be prime. - [fn is_prime](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.is_prime) - [fn is_refutation](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.is_refutation): Re-check a refutation: the chosen combination of equations has every variable coefficient `≡ 0` and a nonzero right-hand side mod `p` — a solver-free certificate of inconsistency. - [fn recover_from_cnf](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.recover_from_cnf): Lift an opaque Boolean CNF onto `ℤ/m`. Recognize the canonical one-hot encoding of a mod-`m` linear system — each variable a group of `m` bits with an at-least-one clause and the full pairwise at-most-one, plus all-negative “forbidden combination” clauses pinning the congruences — and recover the system over `ℤ/m`. The modulus `m` is the group size; it may be prime (a field) or composite (a ring), and `fit_congruence` handles both. Returns `None` (declining, never guessing) unless every clause fits the pattern and every forbidden set is exactly the complement of a single congruence: then the recovered system is equisatisfiable to the CNF, so the modular solver’s verdict transfers (UNSAT certificate carries; a SAT model is re-checked against the clauses by the caller). The `m = 2` case is the parity cut; this is that cut generalized to every modulus — the obstruction GF(2) is blind to, decided in polynomial time where resolution (CDCL, Z3, Kissat) needs `2^Ω(n)`. - [fn satisfies](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.satisfies): Re-check a satisfying assignment: every congruence holds mod `p`. - [fn solve](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.solve): Decide a mod-`p` linear system by Gaussian elimination over `GF(p)`. Returns a satisfying assignment, or an inconsistency-witnessing combination of the original equations. `p` must be prime. - [fn solve_space](https://docs.logicaffeine.com/logicaffeine_proof/modp/fn.solve_space): Solve a `GF(p)` system for its entire solution space via Gaussian elimination to reduced row echelon form, returning the symmetry-broken `SolutionSpaceP` (particular solution + kernel basis), or `None` iff the system is inconsistent. Generalizes `solve`, which returns just one witness, to the full coset — the `GF(p)` analogue of `crate::gf2::solve_gf2`. `p` must be prime. ## logicaffeine_proof::omega_solve `omega` — linear INTEGER arithmetic, the discreteness-aware layer over the rational Farkas core. ## logicaffeine_proof::optimize Certified SAT-based optimization. We have no native MaxSAT/ILP solver, so we minimise an integer cost the honest way: binary-search the smallest feasible cost bound, where each query is a certified decision (`prove_unsat` → `Sat` witness or RUP-`Refuted`). The result is a certified optimum — a witness at the optimum and a refutation at optimum−1 — not merely a value we happened to find. - [struct MinResult](https://docs.logicaffeine.com/logicaffeine_proof/optimize/struct.MinResult): The outcome of a certified minimization. - [fn minimize_certified](https://docs.logicaffeine.com/logicaffeine_proof/optimize/fn.minimize_certified): Binary-search `[lo, hi]` for the least `bound` with `feasible_at(bound)` satisfiable. Returns `None` if even `hi` is infeasible or a query leaves the supported fragment. ## logicaffeine_proof::ordering The ordering-principle specialist — a polynomial-time recognizer + refuter for GT(n), the linear-ordering contradiction. GT(n) asserts a strict total order (totality + antisymmetry + transitivity) in which every element has a strictly greater one (“no maximum”). That is impossible: a finite strict total order always has a maximum. So a complete GT(n) core is unsatisfiable, and any formula containing it (a superset of an UNSAT core) is UNSAT. - [struct OrderingCert](https://docs.logicaffeine.com/logicaffeine_proof/ordering/struct.OrderingCert): A re-checkable ordering-principle refutation: the recovered element/edge identification of a complete GT(n) core. `edge[i * n + j]` is the comparison variable `x_ij` (“i < j”) for the ordered pair `(i, j)`; diagonal entries (`i == j`) are `u32::MAX` and unused. Given this map a checker re-verifies that every totality, antisymmetry, transitivity, and no-maximum clause is present — the whole certificate, no trust in the recognizer. - [fn check_ordering_cert](https://docs.logicaffeine.com/logicaffeine_proof/ordering/fn.check_ordering_cert): Re-check an `OrderingCert` against the raw `clauses` from scratch, trusting nothing about how it was produced: verify that for its element/edge identification EVERY totality, antisymmetry, transitivity, and no-maximum clause is present. `true` iff the certificate genuinely witnesses a complete GT(n) core (which is unsatisfiable), so the formula is UNSAT. - [fn ordering_certificate](https://docs.logicaffeine.com/logicaffeine_proof/ordering/fn.ordering_certificate): Recover a complete ordering-principle (GT(n)) core from `clauses`, or `None` if there is none. On `Some(cert)` the formula is unsatisfiable (a finite strict total order has a maximum, contradicting the no-maximum clauses), and `cert` re-checks via `check_ordering_cert`. Conservative / fail-closed — never a false certificate. See the module docs. - [fn refute_ordering](https://docs.logicaffeine.com/logicaffeine_proof/ordering/fn.refute_ordering): Refute a formula that contains a complete ordering-principle core. `true` iff a certificate is recovered — see `ordering_certificate`. Never a false refutation. - [fn refutes_ordering_principle](https://docs.logicaffeine.com/logicaffeine_proof/ordering/fn.refutes_ordering_principle): The ordering cut over a `ProofExpr`: clausify and run the specialist. This is the entry the cascade (`crate::sat::prove_unsat`) calls. ## logicaffeine_proof::parity_cardinality Fast refuter for the coupled exactly-one + parity family. An exactly-one group (an at-least-one clause plus the full at-most-one clique over its variables) forces EXACTLY one of its selectors true, so their XOR is `1` (odd). If the formula’s parity substructure forces that same XOR to `0` (even), the two are inconsistent and the formula is UNSAT — the mixed obstruction neither theory sees alone. - [fn refute](https://docs.logicaffeine.com/logicaffeine_proof/parity_cardinality/fn.refute): Refute a coupled exactly-one + parity formula. `true` iff some exactly-one group’s odd-parity requirement contradicts the formula’s XOR system. Never a false refutation. ## logicaffeine_proof::period The period / order seam — the classical shell of Shor’s algorithm - [fn factor_from_order](https://docs.logicaffeine.com/logicaffeine_proof/period/fn.factor_from_order): Split `n` from a known order `r` of `a`: if `r` is even and `a^{r/2}` is a nontrivial square root of `1` (`≢ ±1`), then `gcd(a^{r/2} ± 1, n)` is a proper factor. `None` when the order is odd or the root is trivial (`±1`) — the ~50% of the time a fresh `a` is needed. - [fn factor_via_order](https://docs.logicaffeine.com/logicaffeine_proof/period/fn.factor_via_order): Factoring via order-finding — the classical shell of Shor’s algorithm. Draw bases `a`, find each order (bounded by `bound`), and split `n` when the order is even with a nontrivial root. `None` if no trial succeeded within `tries`/`bound`. Classically `O(√order)` per base (exponential in bit length); this is exactly the step Shor’s quantum Fourier transform makes polynomial. - [fn multiplicative_order](https://docs.logicaffeine.com/logicaffeine_proof/period/fn.multiplicative_order): The multiplicative order of `a` modulo `n` — the least `r > 0` with `aʳ ≡ 1 (mod n)` — by baby-step-giant-step, searching orders up to `bound`. `None` if `gcd(a, n) ≠ 1` (no order) or the order exceeds `bound`. Runs in `O(√bound)` field multiplications. ## logicaffeine_proof::permgroup Schreier–Sims: a base and strong generating set (BSGS) for a permutation group — the non-abelian generalization of Gaussian elimination, and the last rung of the algebra ladder (GF(2)→GF(p)→ℤ/m linear; this is the group level). - [struct Bsgs](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/struct.Bsgs): A base and strong generating set, with the per-level basic transversals. - [struct CharacterTable](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/struct.CharacterTable): The character table of `⟨gens⟩`, computed exactly by Dixon’s method. - [fn abelianization](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.abelianization): The abelianisation `G / [G, G]` — the largest abelian quotient — as `(order, exponent)`. The order is `|G| / |[G, G]|`; the exponent (lcm of coset orders) and whether it equals the order — i.e. whether `Gᵃᵇ` is cyclic — are the new structural content. `None` when `|G| > cap`. - [fn automorphism_group_order](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.automorphism_group_order): The order of the automorphism group `Aut(G)` of `G = ⟨gens⟩` — the symmetries of the group itself (bijections `G → G` preserving multiplication, `φ(xy) = φ(x)φ(y)`). An automorphism is determined by the images of a generating set, so the search ranges over candidate images (each generator must map to an element of the same order, a necessary condition) and accepts those that extend to a consistent, bijective homomorphism. `None` when `|G| > cap` or the candidate search would exceed its budget. Classic: `|Aut(Cₙ)| = φ(n)`, `|Aut(Sₙ)| = n!` (n≠6), `|Aut(V₄)| = 6`, `|Aut(D₄)| = 8`, `|Aut(Q₈)| = 24`. - [fn burnside_ring_product](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.burnside_ring_product): The Burnside ring multiplication of `G = ⟨gens⟩` — the structure constants `N[a][b][l]` giving the decomposition of the product G-set `(G/H_a) × (G/H_b) = ⊔_l N[a][b][l]·(G/H_l)` into transitive G-sets, indexed by the conjugacy classes of subgroups (same order as `table_of_marks`). - [fn center_order](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.center_order): The order of the centre `Z(G)` — the elements commuting with all of `G`, which are exactly those in singleton conjugacy classes. `None` when `|G| > cap`. - [fn character_table](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.character_table): Compute the full character table via the Burnside–Dixon algorithm: build the commuting class-algebra matrices `M_i` from the structure constants, choose a Dixon prime `p`, simultaneously diagonalise the `M_i` over `GF(p)` by iterated eigenspace refinement (one common eigenvector per irreducible), then read off each degree `d_s` (exact integer, via `d² = |G|/Σ_r ω_r ω_{r̄}/|C_r|`) and the character values `χ_s(C_r) = d_s ω_r/|C_r|`. Returns `None` when `|G| > cap`, the group is too large for the finite-field arithmetic, or — FAIL-CLOSED — the recovered table does not satisfy the row-orthogonality and degree relations (so a returned table is always a verified one). Rows are sorted by `(degree, values)` for determinism. - [fn class_multiplication_coefficients](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.class_multiplication_coefficients): The class-algebra structure constants `a[i][j][k] = #{ x ∈ Cᵢ : x⁻¹·z ∈ Cⱼ }` for `z` a fixed representative of class `Cₖ` (independent of the choice of `z`). These are the multiplication coefficients of the centre of the group algebra — `Cᵢ·Cⱼ = Σₖ a[i][j][k]·Cₖ` — and the foundation of the Burnside–Dixon character-table algorithm. They satisfy `Σₖ a[i][j][k]·|Cₖ| = |Cᵢ|·|Cⱼ|`. `None` when `|G| > cap`. - [fn composition_factor_orders](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.composition_factor_orders): The composition factors of the group as the sorted multiset of their orders — the Jordan–Hölder decomposition into simple groups (the “prime factorisation” of the group). Their product is `|G|`; for a solvable group every factor is a prime (cyclic `Cₚ`), and a non-abelian simple factor (e.g. `A₅`, order 60) marks unsolvability. `None` when the group is out of range. - [fn conjugacy_classes](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.conjugacy_classes): The conjugacy classes of the group — the partition of its elements by `g ~ x⁻¹gx`. The number of classes equals the number of irreducible representations (the bridge to character theory); the singleton classes are exactly the centre `Z(G)`. Requires enumerating the group, so it returns `None` when `|G| > cap`. - [fn cycle_index](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.cycle_index): The cycle index data — the distribution of cycle types over the group, mapping each cycle type to the number of elements with it. Dividing by `|G|` gives the cycle index polynomial, the engine of Pólya enumeration. `None` when `|G| > cap`. - [fn derived_length](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.derived_length): The derived length (solvability class): the number of steps the derived series `G ⊵ G' ⊵ G'' ⊵ …` takes to reach the trivial group, or `None` if it never does (`G` is unsolvable). `0` is the trivial group, `1` a non-trivial abelian group, `2` for `S₃`, `3` for `S₄`. - [fn derived_subgroup](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.derived_subgroup): Generators of the derived (commutator) subgroup `[G, G]` — the normal closure of the commutators of the generators. Always normal; `G / [G, G]` is the abelianisation, and `[G, G]` is trivial iff `G` is abelian. - [fn element_orders](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.element_orders): The order spectrum — the set of distinct orders of the group’s elements. `None` when `|G| > cap`. - [fn exponent](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.exponent): The exponent of the group — the least common multiple of all element orders, i.e. the smallest `e` with `gᵉ = id` for every `g`. `None` when `|G| > cap`. - [fn frobenius_schur_from_table](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.frobenius_schur_from_table): The Frobenius–Schur indicators `ν(χ_s) = (1/|G|) Σ_{g∈G} χ_s(g²) ∈ {+1, 0, −1}` read off a character table: `+1` if the irreducible is real (orthogonal), `0` if complex (`χ ≠ χ̄`), `−1` if quaternionic (symplectic). Computed exactly over the table’s `GF(p)`: `Σ_r |C_r|·χ_s(C_{r²})`, scaled by `1/|G|`, decoded `{0, 1, p−1} → {0, 1, −1}`. FAIL-CLOSED: returns `None` if any value decodes outside `{−1,0,1}` or the Frobenius–Schur sum rule `Σ_s ν(χ_s)·d_s = #{g : g²=1}` fails. The indicators distinguish groups with identical character tables (e.g. `D₄` all `+1` vs `Q₈` with a `−1`). - [fn frobenius_schur_indicators](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.frobenius_schur_indicators): The Frobenius–Schur indicators of `⟨gens⟩`, one per irreducible character (aligned with `character_table`’s rows). See `frobenius_schur_from_table`. `None` when the character table is out of range. - [fn galois_class_orbits](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.galois_class_orbits): The Galois orbits on conjugacy classes. The Galois group `Gal(ℚ(ζ_e)/ℚ) ≅ (ℤ/e)*` (`e` = the group exponent) acts on classes by `C ↦ C^t` (the class of `g^t`), for every `t` coprime to `e` — this is the action dual to the Galois action `σ_t(χ)(g) = χ(g^t)` on irreducible characters. Two classes share an orbit iff they are algebraically conjugate (`g ~ g^t` for some coprime `t`). `None` when `|G| > cap`. - [fn generating_tuple_count](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.generating_tuple_count): The number of ordered `k`-tuples of group elements that generate `G` — the Eulerian function `e_k(G) = Σ_{H ≤ G} μ(H, G)·|H|ᵏ` (Hall’s formula by Möbius inversion over the subgroup lattice, since `|H|ᵏ` counts the `k`-tuples landing in `H`). Dividing by `|G|ᵏ` gives the probability that `k` random elements generate `G`. `None` when `|G| > cap`. - [fn irreducible_degrees](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.irreducible_degrees): The irreducible-representation degrees `χ_s(1)` of `⟨gens⟩`, sorted ascending (`Σ dᵢ² = |G|`) — the cheap summary of the `character_table`. `None` when the table cannot be computed (`|G| > cap` or too large for the finite-field diagonalisation). - [fn is_abelian](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.is_abelian): Is the group abelian? (Its generators pairwise commute.) - [fn is_nilpotent](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.is_nilpotent): Is the group nilpotent? (Its lower central series reaches the trivial group.) Strictly stronger than solvability — every `p`-group is nilpotent, but `S₃` (solvable) is not. - [fn is_primitive](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.is_primitive): Is the group primitive — transitive with no non-trivial block system? Primitive groups are the indecomposable “atoms” of permutation-group structure; imprimitive ones split into blocks (`minimal_block_system`). - [fn is_primitive_via_orbitals](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.is_primitive_via_orbitals): Primitivity via Higman’s theorem: a transitive group is primitive iff every non-diagonal orbital graph is connected. An independent route to `is_primitive`; when a non-diagonal orbital graph is disconnected, its connected components are a block system. (Returns `false` for an intransitive group.) - [fn is_simple](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.is_simple): Is the group simple — non-trivial with no normal subgroup but `{id}` and itself? Tested via conjugacy: every non-trivial normal subgroup contains the whole conjugacy class of any of its elements, hence the normal closure of that element. So `G` is simple iff the normal closure of every non-identity element is all of `G`. Simple non-abelian groups (e.g. `A₅`) are exactly the unsolvable building blocks. `None` when `|G| > cap`. - [fn is_solvable](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.is_solvable): Is the group solvable? (Its derived series reaches the trivial group.) - [fn isotypic_from_table](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.isotypic_from_table): The isotypic decomposition of the permutation representation: the multiplicity `m_s = ⟨π, χ_s⟩` of each irreducible `χ_s` in the natural action’s character `π`, i.e. `π = Σ_s m_s χ_s`. Computed from a character table: `m_s = (1/|G|) Σ_r |C_r|·π(C_r)·χ_s(C_{r̄})` over the table’s `GF(p)`. The representation-theoretic spectrum of the symmetry — it ties the linear theory back to the action: `m_trivial = #orbits` (Burnside), `Σ_s m_s² = rank` (#orbitals), `Σ_s m_s·d_s = degree`. FAIL-CLOSED: `None` if `p ≤ degree` (then the small non-negative `m_s ≤ degree` would not decode uniquely) or if any of those three identities fails. Aligned with the table’s rows. - [fn isotypic_multiplicities](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.isotypic_multiplicities): The isotypic multiplicities of `⟨gens⟩`’s permutation representation, one per irreducible (aligned with `character_table`’s rows). See `isotypic_from_table`. `None` when the character table is out of range or the multiplicities cannot be decoded/verified. - [fn minimal_block_system](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.minimal_block_system): The minimal non-trivial block system of a TRANSITIVE permutation group — the finest `G`-invariant partition into equal-size blocks bigger than a point and smaller than the whole set — or `None` if the group is primitive (only the trivial partitions are invariant) or not transitive. Imprimitivity is the symmetry’s internal structure: a grid symmetry decomposes into its rows, a cyclic group of composite order into cosets. (Atkinson’s algorithm over each pair `{0, β}`.) - [fn mobius_number](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.mobius_number): The Möbius number `μ(1, G)` of the subgroup lattice of `G = ⟨gens⟩` — the value of the lattice’s Möbius function from the trivial subgroup to the whole group. A classical invariant: for a cyclic group `μ(1, Cₙ)` is the number-theoretic Möbius function `μ(n)`, and in general it drives the group’s Eulerian (probabilistic-zeta) function. `None` when `|G| > cap`. - [fn nilpotency_class](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.nilpotency_class): The nilpotency class: the number of steps the lower central series `γ₁ = G`, `γ_{k+1} = [G, γ_k]` takes to reach the trivial group, or `None` if it never does (`G` is not nilpotent). `0` is trivial, `1` abelian, `2` for `D₄`. - [fn orbitals](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.orbitals): The orbitals — the orbits of the group on ORDERED PAIRS `(i, j)` under the action `g·(i,j) = (g[i], g[j])`. The diagonal `{(i,i)}` is always one orbital; for a transitive group the non-diagonal orbitals are its “relation classes” (its association scheme). The count is the group’s `rank`. One level finer than the point-orbits (`orbits`). - [fn orbits](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.orbits): The orbits of `{0,…,degree−1}` under `⟨generators⟩`, as a partition (each orbit sorted ascending, orbits ordered by least element). Needs only the generators — a BFS, independent of the BSGS. - [fn orbits_on_tuples](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.orbits_on_tuples): The orbits of the group on ordered `k`-tuples of distinct points (`g·(t₁,…,t_k) = (g[t₁],…,g[t_k])`). `k = 1` is the point-orbits (`orbits`); `k = 2` (on distinct pairs) refines `orbitals`; in general the group is `k`-transitive iff this is a single orbit — the rungs of the transitivity ladder. - [fn outer_automorphism_order](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.outer_automorphism_order): The order of the outer automorphism group `Out(G) = Aut(G)/Inn(G)`, where the inner automorphisms `Inn(G) ≅ G/Z(G)` are those realised by conjugation. `Out(G)` counts the “exotic” symmetries of the group not coming from within it. `None` when out of range. - [fn pattern_inventory](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.pattern_inventory): The pattern inventory (weighted Pólya, two colours) — `coeff[w]` is the number of distinct `{0,1}` assignments to the points with exactly `w` ones, up to the group. Obtained by substituting `aₖ → (1 + zᵏ)` into the cycle index: a `k`-cycle is either all-0 or all-1, contributing `1 + zᵏ`. The coefficients sum to `polya_count``(…, 2, …)`. `None` when `|G| > cap`. - [fn permutation_character](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.permutation_character): The permutation character `π(g) = #{points fixed by g}` of the natural action of `⟨gens⟩` on its `degree` points, valued per conjugacy class (a class invariant, since conjugate permutations have the same cycle type). The character of the permutation representation `ℂ^degree`. Aligned with the conjugacy classes (so with `CharacterTable`’s columns). `None` when `|G| > cap`. - [fn permutation_character_decomposition](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.permutation_character_decomposition): The permutation-character decomposition — the bridge between the table of marks and the character table. `M[i][s]` is the multiplicity of the irreducible `χ_s` in the permutation representation of `G` on the cosets `G/H_i`, i.e. `M[i][s] = ⟨Ind_{H_i}^G 1, χ_s⟩ = (1/|H_i|)·Σ_{h ∈ H_i} χ_s(h)` (Frobenius reciprocity = the dimension of the `H_i`-fixed subspace of `χ_s`). Rows are subgroup conjugacy classes (as in `table_of_marks`), columns are irreducibles (as in `character_table`). Returns `(subgroup_orders, irreducible_degrees, M)`. - [fn polya_count](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.polya_count): Pólya / Burnside count — the number of ways to colour the `degree` points with `m` colours up to the group action: `(1/|G|) Σ_g m^{#cycles(g)}`. With `m = 2` this is the number of distinct `{0,1}` assignments to the points modulo symmetry — the symmetry-reduced size of the assignment space. `None` when `|G| > cap`. - [fn rank](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.rank): The rank of the group: the number of orbitals (orbits on ordered pairs). A transitive group has rank `2` iff it is 2-transitive; a regular group has rank equal to its degree. - [fn rational_class_count](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.rational_class_count): The number of rational conjugacy classes — classes `C` fixed by the whole Galois group (`g ~ g^t` for every `t` coprime to `ord(g)`), i.e. the singleton `galois_class_orbits`. By Burnside’s rationality theorem this equals the number of rational-valued irreducible characters. Strictly refines `real_class_count` (real = closed under the single element `t = −1`): rational ⟹ real, and the counts differ exactly when a character is real but irrational (e.g. `A₅`’s golden-ratio degree-3 pair). `None` when `|G| > cap`. - [fn real_class_count](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.real_class_count): The number of real conjugacy classes — those closed under inversion (`C = C⁻¹`). By Burnside’s theorem this equals the number of real-valued irreducible characters. `None` when `|G| > cap`. - [fn schreier_sims](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.schreier_sims): Schreier–Sims. Build a BSGS for the permutation group on `degree` points generated by `generators` (each a permutation of `{0,…,degree−1}`). Deterministic incremental construction: seed the chain with the generators, then repeatedly sift every Schreier generator (`u·s` divided by its transversal element, Schreier’s lemma) into the chain, adding any non-trivial residue as a new strong generator (extending the base as needed), until every Schreier generator sifts to the identity — the completeness condition. - [fn subgroup_count](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.subgroup_count) - [fn sylow_counts](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.sylow_counts): The Sylow structure — for each prime `p ∣ |G|`, the number `n_p` of Sylow `p`-subgroups (the subgroups of maximal `p`-power order `pᵃ ∥ |G|`; all such subgroups are conjugate, so counting them counts the Sylow subgroups). Returned as `(p, n_p)` pairs sorted by `p`. Sylow’s theorems guarantee `n_p ≡ 1 (mod p)` and `n_p ∣ |G|/pᵃ`. `None` when the subgroup lattice is out of range. - [fn table_of_marks](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.table_of_marks): The table of marks of `G = ⟨gens⟩` — the Burnside-ring analogue of the character table. Rows and columns are the conjugacy classes of subgroups (ordered by increasing order); the `(i,j)` entry is the mark `m(H_i, H_j)` = the number of `H_i`-fixed points in the transitive action of `G` on the cosets `G/H_j`, computed as `(1/|H_j|)·|{g ∈ G : g⁻¹ H_i g ⊆ H_j}|`. Returns `(subgroup_class_orders, marks)`. - [fn tensor_decomposition](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.tensor_decomposition): The tensor (fusion) decomposition of `⟨gens⟩`’s irreducibles. See `tensor_from_table`. `None` when the character table is out of range or the fusion coefficients fail their structural checks. - [fn tensor_from_table](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.tensor_from_table): The tensor (Clebsch–Gordan) decomposition of the irreducibles: `N[i][j][k] = ⟨χ_i·χ_j, χ_k⟩`, the multiplicity of `χ_k` in the tensor product `χ_i ⊗ χ_j`. These are the fusion coefficients — the structure constants of the representation ring `R(G)` (the multiplication dual to the character table’s addition). Computed from a character table: `N[i][j][k] = (1/|G|) Σ_r |C_r|·χ_i(C_r)·χ_j(C_r)·χ_k(C_{r̄})` over the table’s `GF(p)`; each is a small non-negative integer `≤ d_i·d_j ≤ |G| < p`, so it decodes uniquely. FAIL-CLOSED: returns `None` unless every fusion product has the right dimension (`Σ_k N[i][j][k]·d_k = d_i·d_j`), the trivial character is a unit (`χ_triv ⊗ χ_j = χ_j`), and the coefficients are symmetric (`N[i][j][k] = N[j][i][k]`). Indices align with `character_table`’s rows. - [fn transitivity_degree](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.transitivity_degree): The transitivity degree: the largest `t ≤ max_t` for which the group is transitive on ordered `t`-tuples of distinct points (`1` = transitive, `2` = 2-transitive, …). `0` if intransitive. Capped at `max_t` because the `t`-tuple space grows as `degree^t`. `Sₙ` is `n`-transitive; a regular group is only `1`-transitive. - [fn upper_central_length](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.upper_central_length): The length of the upper central series when it reaches `G` (the nilpotency class) — `None` if it stalls below `G` (the group is not nilpotent) or `|G| > cap`. Equals `nilpotency_class` for nilpotent groups, an independent route to the same number. - [fn upper_central_series](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/fn.upper_central_series): The orders `[|Z₀|, |Z₁|, …]` of the upper central series, up to the hypercentre. `Z₀ = {id}` and `Z_{i+1} = { g : [g, x] ∈ Z_i for all x }` (the preimage of the centre of `G/Z_i`). The series ascends to `|G|` iff `G` is nilpotent. `None` when `|G| > cap`. - [type Perm](https://docs.logicaffeine.com/logicaffeine_proof/permgroup/type.Perm): A permutation of `{0,…,n−1}`: `p[x]` is the image of point `x`. ## logicaffeine_proof::pigeonhole Pigeonhole / bipartite-matching detection for the general solver — the cardinality reasoning that lets `prove_unsat` win on pigeonhole-shaped formulas in POLYNOMIAL time. - [struct CountingCert](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/struct.CountingCert): The pigeonhole counting certificate — the symmetry break taken to its absolute limit. For the complete bipartite instance `PHP(pigeons → holes)` (every pigeon may use every hole, each hole ≤ 1 pigeon), the full pigeon set has neighborhood = all `holes` slots, so Hall’s condition fails the instant `pigeons > holes`. That single inequality IS the refutation — sound, `O(1)`, and scale-free. - [fn certify_pigeonhole_unsat](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/fn.certify_pigeonhole_unsat): Certify `PHP(pigeons → holes)` UNSAT by pure counting, in `O(1)`. `Some` iff `pigeons > holes` (Hall violated by the full pigeon set); `None` otherwise (feasible — a perfect matching can exist). - [fn check_counting_cert](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/fn.check_counting_cert): Re-check a counting certificate from scratch: it witnesses UNSAT iff `pigeons > holes`. `O(1)`, zero trust in how it was produced — the whole refutation is one inequality. - [fn counting_certificate](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/fn.counting_certificate): Expose the O(1) counting certificate for any matching-shaped cover, not just literal pigeonhole: recover the bipartite `(items → slots)` structure and certify UNSAT by the full-set Hall bound `items > slots`. Fires for pigeonhole and clique-coloring (`n` vertices, `k < n` colors) — the same crush, derived structurally. `None` when there is no such bipartite structure or the full set does not overflow the slots (a subset-Hall failure is still caught by `decide_pigeonhole_unsat`). - [fn decide_pigeonhole_unsat](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/fn.decide_pigeonhole_unsat): Decide whether `e` is a clean pigeonhole structure that is UNSAT. Returns `true` ONLY when the formula decomposes faithfully into at-least-one rows + fully-encoded (clique) at-most-one columns AND the bipartite matching is infeasible with a RE-VERIFIED Hall witness. `false` otherwise — for a non-pigeonhole formula, or a feasible one (the caller falls back to CDCL). Never a false `true`. - [fn hall_refutation](https://docs.logicaffeine.com/logicaffeine_proof/pigeonhole/fn.hall_refutation): The full Hall certificate — the matching symmetry invariant in its complete form. A bipartite cover is infeasible the moment some subset `S` of items reaches fewer than `|S|` slots, even when the totals balance and the crude `items > slots` bound sees nothing. Returns the violating subset (re-checked by `is_hall_witness`), strictly stronger than `counting_certificate`. This is the witness behind `decide_pigeonhole_unsat`’s verdict, surfaced. ## logicaffeine_proof::polycalc Polynomial Calculus / Nullstellensatz over `GF(2)` — the algebraic proof system that subsumes the linear cuts (parity is its degree-1 fragment) and, at higher degree, refutes strictly more. - [struct NsCertificate](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/struct.NsCertificate): A constructive Nullstellensatz certificate over the multilinear `GF(2)` ring: one coefficient polynomial `g_C` per input clause such that `Σ_C p_C · g_C = 1`, where `p_C = clause_polynomial(C)` is the clause’s false-indicator. The identity is a re-checkable proof of UNSAT — evaluate it at any assignment `a`: the right side is `1`, so some `p_C(a) = 1`, i.e. every assignment falsifies some clause. Where `nullstellensatz_refutes` only decides whether such a certificate exists, this one carries the witness. - [fn apply_perm_to_mono](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.apply_perm_to_mono): Apply a formula automorphism to a monomial: a monomial is a set of variables, so the permutation part of `σ` relabels them (phase flips do not act on monomials). The bridge from the symmetry group to the polynomial basis. - [fn build_ns_certificate](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.build_ns_certificate): The uniform Nullstellensatz completeness construction. For any CNF over `num_vars ≤ 20` variables, return either a constructive `NsCertificate` proving UNSAT, or a satisfying assignment proving SAT — a total, certifying decision. The construction is the partition of unity `Σ_a δ_a = 1`: every corner `a` is charged to one clause it falsifies (a corner that falsifies none is a model — SAT), and the coefficient of clause `C` is `g_C = Σ_{a charged to C} δ_a`. Then `Σ_C p_C · g_C = Σ_a p_{sel(a)} · δ_a = Σ_a δ_a = 1`, because `p_{sel(a)}(a) = 1` collapses `p·δ_a` to `δ_a` on the cube (multilinear representations are unique). Because this succeeds identically at every `n`, it does not merely measure but proves that every unsatisfiable formula has a degree-`≤ n` `GF(2)` Nullstellensatz refutation — no minimal-UNSAT family is structureless, at any `n`. This is the census’s `max_ns_degree = n` ceiling as a construction, settling `n = 5, 6, …` where the orbit census is infeasible. - [fn check_ns_lower_bound](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.check_ns_lower_bound): Re-check a `ns_lower_bound_witness` certificate (zero trust in the producer): the functional `L` (given as the monomials on which it is `1`) must satisfy `L(1) = 1` and `L(m · p_C) = 0` for every degree-`≤ d` generator. `true` ⟹ `F` genuinely has no degree-`d` `GF(2)` Nullstellensatz refutation. - [fn check_ns_lower_bound_polys](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.check_ns_lower_bound_polys): Re-check a `ns_lower_bound_witness_polys` certificate (zero trust in the producer): `L(1) = 1` and `L(m·g) = 0` for every admitted generator of the system. `true` ⟹ the generator system genuinely has no degree-`d` `GF(2)` Nullstellensatz refutation. Degree-bounded enumeration — `num_vars ≤ 63`. - [fn clause_polynomial](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.clause_polynomial): The clause polynomial: `1` exactly on the clause’s falsifying assignment. The false-indicator of a positive literal `x` is `1 + x` (`{∅, {x}}`), of a negative literal `¬x` is `x` (`{{x}}`); the clause polynomial is their product. Degree = clause width. - [fn close_perm_group](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.close_perm_group): The closure of a permutation group under composition (BFS), for small groups. Elements keyed by their image vector so the group is deduplicated. - [fn exactly_one_linear_generators](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.exactly_one_linear_generators): The linear encoding of exactly-one constraints: for each group `G` the degree-1 generator `1 + Σ_{v∈G} x_v` (the `GF(2)` form of `Σ x = 1`) plus the pairwise products `x_u·x_v` over each group, deduplicated. This is the encoding under which the modular-counting and pigeonhole degree lower bounds are stated in the literature — the wide at-least-one clause is recovered from it modulo the pairs (the interreduction test pins the identity, and the clause→linear direction is degree-preserving, so bounds against this encoding are the stronger statements). The linear generators come first (one per group, in group order), then the pairs. - [fn gf2_solve](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.gf2_solve): Solve a `GF(2)` linear system `⟨x, coeffᵢ⟩ = rhsᵢ` (each `coeff` a multi-word bit-vector over `nvars` variables) by Gaussian elimination to reduced row echelon form. Returns any solution `x` (bit-packed into `⌈nvars/64⌉` words) or `None` if the system is inconsistent. Multi-word, so it scales past 63 variables. - [fn monomial_orbits](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.monomial_orbits): Symmetry-break Polynomial Calculus at the basis. Partition the degree-≤`degree` monomials into orbits under the formula’s automorphisms. The orbit count is the width of the symmetry-reduced Nullstellensatz system — a symmetric certificate is constant on each orbit, so the Gaussian runs over the quotient instead of all `C(n,d)` monomials. The same collapse that made the field cuts O(1), inherited by the algebraic engine. (Bounded to `num_vars ≤ 20`.) - [fn monomials_up_to_degree](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.monomials_up_to_degree): All squarefree monomials of degree `≤ degree` over `num_vars ≤ 63` variables, ascending as `u64`s — enumerated directly (Gosper’s next-`k`-subset walk per degree class), never touching the `2ⁿ` cube. This is the basis walk that lifts fixed-degree Nullstellensatz work past the clause engine’s 20-variable cap: the count is `Σ_{k≤d} C(n,k)` (`nullstellensatz_basis_size`), not `2ⁿ`. - [fn ns_lower_bound_witness](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.ns_lower_bound_witness): A re-checkable degree-`d` Nullstellensatz LOWER-bound certificate. Where `nullstellensatz_refutes` decides whether a degree-`d` refutation exists, this witnesses its NON-existence: a `GF(2)` linear functional `L` on the degree-`≤ d` monomials (a *degree-`d` pseudo-expectation`) with `L(1) = 1`and`L(m · p_C) = 0`for every generator. Such an`L`exists iff`1`is **not** in the`GF(2)`-span of the generators, i.e. iff there is no degree-`d`refutation — so`Some(L)`certifies the lower bound`NS-degree(F) > d`, independently re-checkable by [`check_ns_lower_bound`] (no trust in the solver). The certificate is returned as the list of monomials on which `L`is`1`. `None` means a degree-`d`refutation exists (no lower bound at`d`). Multi-word linear algebra, so the monomial basis is not size-capped — only `num_vars ≤ 20` for the explicit basis enumeration. - [fn ns_lower_bound_witness_on_basis](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.ns_lower_bound_witness_on_basis): `ns_lower_bound_witness` restricted to a sub-basis of monomials: the functional `L` is sought only on monomials `m` with `in_basis(m)` (and `L = 0` elsewhere), while the constraints `⟨L, m·p_C⟩ = 0` still range over all generators. `Some(L)` is a fully valid, `check_ns_lower_bound`-verifiable witness (the restriction only limits the search, not the check); `None` here means “no witness on this sub-basis” — which, unlike the full-basis version, does not imply a refutation exists. This exposes the structure of a lower bound: e.g. for pigeonhole, the partial-matching sub-basis already carries the certificate. - [fn ns_lower_bound_witness_polys](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.ns_lower_bound_witness_polys): `ns_lower_bound_witness` for an arbitrary polynomial generator system: a degree-`d` pseudo-expectation `L` with `L(1) = 1` and `L(m·g) = 0` for every admitted generator, returned as the monomials where `L = 1`. `Some(L)` certifies `NS-degree > d` for the system (re-checkable by `check_ns_lower_bound_polys`, zero trust in the solver); `None` means a degree-`d` refutation exists. Degree-bounded enumeration — `num_vars ≤ 63`. - [fn ns_lower_bound_witness_polys_on_basis](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.ns_lower_bound_witness_polys_on_basis): `ns_lower_bound_witness_polys` restricted to a sub-basis: the functional `L` is sought only on monomials passing `in_basis` (`L = 0` elsewhere), while the constraints `⟨L, m·g⟩ = 0` still range over all admitted generators — so any `Some` is a fully valid, `check_ns_lower_bound_polys`-verifiable witness, and `None` means only “no witness on this sub-basis”. The structure probe: which candidate supports carry a family’s lower bound (for pigeonhole this is how the hole-injective support was found and the classical partial-matching support was ruled out over `GF(2)`). Degree-bounded enumeration — `num_vars ≤ 63`. - [fn ns_refutes_polys](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.ns_refutes_polys): Does a degree-`d` Nullstellensatz refutation exist over `GF(2)` for an arbitrary polynomial generator system — is `1` in the `GF(2)`-span of `{ m·g : deg(m·g) ≤ d }`? The clause engine’s question asked of any generators, not just clause polynomials: the substrate for the linear encoding (`exactly_one_linear_generators`) and the symmetric-family machinery. The multiplier rule is exact — a product is admitted by its degree after multilinear collapse. (For clause polynomials this span equals the clause engine’s: a multiplier overlapping a positive literal kills the product, one overlapping a negative literal absorbs into a smaller multiplier — pinned by the differential test.) Degree-bounded enumeration, so it scales to `num_vars ≤ 63`. - [fn nullstellensatz_basis_size](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.nullstellensatz_basis_size): The width of the degree-`d` Nullstellensatz system over `n` variables: the count of multilinear monomials of degree `≤ d`, `Σ_{k≤d} C(n,k)`. At `d = n` this is exactly `2ⁿ` — so the degree-`n` certificate that `build_ns_certificate` always produces (completeness: no unsatisfiable formula over `n` variables is “structureless”) lives in an exponentially large space. The certificate’s existence is an information-theoretic fact about the finite cube; it is not an efficient algorithm, and it says nothing about P vs NP — which is a statement about the asymptotic growth of a family of instances, not any fixed finite `n` (a fixed finite problem is decidable by table lookup, vacuously). - [fn nullstellensatz_refutes](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.nullstellensatz_refutes): Does a degree-`d` Nullstellensatz refutation exist over `GF(2)`? Sound: such a certificate exists only when the formula is unsatisfiable. Complete at `d = num_vars` (full degree decides any instance). Bounded to `num_vars ≤ 20` (the explicit monomial basis). - [fn nullstellensatz_refutes_symmetric](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.nullstellensatz_refutes_symmetric): Symmetry-reduced Nullstellensatz — the algebraic refutation collapsed by the formula’s symmetry. Full degree-`d` NS asks whether `1` lies in the `GF(2)`-span of the generators `m·p_C`, a Gaussian over up to `C(n,≤d)` monomial columns. When the formula has a symmetry group `G`, summing each generator’s `G`-orbit gives an invariant generator, and every invariant polynomial is constant on the monomial orbits (`monomial_orbits`) — so the same span check runs over just `#orbits` columns and `#generator-orbits` rows. For a symmetric family that is the difference between `2^Θ(n)` and `O(1)`. - [fn partition_of_unity](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.partition_of_unity): The partition of unity over the `n`-cube: `Σ_{a ∈ {0,1}ⁿ} δ_a`, the sum of every corner’s point-indicator. It is the constant `1` for all `n` — the identity the constructive Nullstellensatz certificate (`build_ns_certificate`) rests on. Computed here by direct summation (for finite checks); `pou_as_product` gives the closed form that proves it `∀n`. - [fn php_is_hole_injective](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.php_is_hole_injective): Is a `PHP` monomial hole-injective — no two of its edges share a hole? Standard PHP forbids two pigeons in one hole but allows a pigeon in several holes, so the at-most-one clauses force the `GF(2)` pseudo-expectation to vanish exactly on hole-collision monomials — i.e. its support lies in the hole-injective monomials (partial functions hole→pigeon). This is looser than a partial matching (which also forbids pigeon repeats) and is the correct `GF(2)` support. - [fn php_is_partial_matching](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.php_is_partial_matching): Is a `PHP` monomial a partial matching — an injective partial pigeon→hole map? PHP’s variable `x_{p,h}` sits at index `p·holes + h` (`crate::families::php`), so a monomial (a set of variables) is a partial matching iff no two of its variables share a pigeon or a hole. This is the support of the Razborov degree lower bound’s pseudo-expectation. - [fn poly_degree](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.poly_degree): The degree of a multilinear `GF(2)` polynomial: its largest monomial’s popcount (`0` for the zero polynomial and for the constant `1`). - [fn poly_mul_mono](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.poly_mul_mono): `p · m`: multiply a polynomial by a monomial over `GF(2)` (monomials are variable sets, so the product is the union, and equal products cancel in pairs). - [fn polynomial_calculus_refutes](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.polynomial_calculus_refutes): Does a degree-`d` Polynomial Calculus refutation exist over `GF(2)`? PC is the dynamic strengthening of Nullstellensatz: start from the clause polynomials and close under (i) `GF(2)` linear combination and (ii) multiplication by a single variable, keeping every derived polynomial multilinear of degree ≤ `d`; the system is refuted iff the constant `1` is derived. Because an intermediate linear combination can cancel high-degree terms before the next multiply, degree-`d` PC certifies a superset of what degree-`d` Nullstellensatz can (which must hit each axiom with a single monomial in one shot). Sound — `1` is derivable only from an unsatisfiable system — and `PC ⊇ NS`, so it never refutes fewer. Complete at `d = num_vars`. Bounded to `num_vars ≤ 20`. - [fn pou_as_product](https://docs.logicaffeine.com/logicaffeine_proof/polycalc/fn.pou_as_product): The closed form of the partition of unity: the product `Π_{v 0 0`, deletions as ` d 0`, and a final empty-clause line. Returns `EmitError::PrInRupOnlyFormat` for any `Pr` step (LRAT proper carries no PR witness). - [fn emit_sr](https://docs.logicaffeine.com/logicaffeine_proof/proof_emit/fn.emit_sr): Emit our refutation in Marijn Heule’s `.sr` (substitution-redundancy) proof format — the input `sr2drat` expands into plain DRAT for `drat-trim` to verify. This is the pipeline that makes our marquee symmetry proofs externally machine-checkable, closing the “SR witnesses not yet exportable” gap: a `Pr` step carrying a `Witness::Substitution` no longer dead-ends at `EmitError::RequiresSubstitutionRedundancy` but is written as a substitution line `sr2drat` knows. - [fn parse_dpr](https://docs.logicaffeine.com/logicaffeine_proof/proof_emit/fn.parse_dpr): Parse a DRAT/DPR proof body back into `ProofStep`s — one clause per line. A bare `C 0` line is a RUP addition; `C 0 ω 0` is a PR addition with an `Witness::Assignment`; `d C 0` is a deletion. Used to round-trip our own emission through our own checker. - [fn try_assignment_witness](https://docs.logicaffeine.com/logicaffeine_proof/proof_emit/fn.try_assignment_witness): Reduce a `Witness` to a standard PR assignment witness for `clause` against `db`, returning `Some(ω)` only when `ω` genuinely satisfies `pr::is_pr` — so the caller can emit a `dpr-trim`-checkable line — and `None` when the witness is irreducibly SR. - [fn write_sr](https://docs.logicaffeine.com/logicaffeine_proof/proof_emit/fn.write_sr): Streaming core of `emit_sr`: write the SR proof into any `core::fmt::Write` sink rather than a `String`, so its serialized size can be measured through a capped `SizeSink` in O(1) memory (and bail early on a pathological proof) instead of building the whole text. Byte-for-byte identical to `emit_sr`; the `String`-backed wrapper above simply cannot hit `EmitError::SizeCapExceeded`. ## logicaffeine_proof::proof_rewrite The proof-rewrite 2-cells — independent refutation steps commute, and the commutation squares make the space of proof-orderings a contractible `CAT(0)` cube complex. This is the honest higher structure the symmetry tower pointed at, and it is genuine 2-dimensional homotopy: not a faked `π₂`, but the coherence theorem for proofs — every way of reordering independent steps is coherently the same, up to all higher homotopies. - [struct ProofPoset](https://docs.logicaffeine.com/logicaffeine_proof/proof_rewrite/struct.ProofPoset): A dependency poset on `n` proof steps. `prec[i][j]` means step `i` must come strictly before step `j` in any valid ordering (its transitive antecedent). Two steps are independent iff neither precedes the other — they commute. Small `n` only (`≤ 20`); it enumerates ideals and cubes, which is the point: it makes the coherence visible and checkable. - [fn disjoint_double_contradiction](https://docs.logicaffeine.com/logicaffeine_proof/proof_rewrite/fn.disjoint_double_contradiction): Two var-disjoint contradictions: vars `{0,1}` and `{2,3}`, each an unsatisfiable 2-variable block. Its four RUP lemmas `(1), (¬1), (3), (¬3)` are derived from the originals alone — pairwise independent proof steps, the cleanest place to see the commutation 2-cells on a real refutation. - [fn permutations](https://docs.logicaffeine.com/logicaffeine_proof/proof_rewrite/fn.permutations): Every permutation of `0..k` — the orderings to feed the real checker. ## logicaffeine_proof::pseudo_boolean Pseudo-Boolean constraints + cutting planes — a proof system STRICTLY STRONGER than resolution. - [struct CardinalityTheory](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/struct.CardinalityTheory): A live cardinality theory for the CDCL engine (`crate::cdcl::Theory`) — the trail-driven twin of the static cutting-plane refuter `refute_clausal`. It propagates and conflicts on unit-coefficient cardinality constraints (`Σ ℓ ≥ k`, covering clauses, at-least-`k`, and at-most-`k`) directly on the solver’s trail (stateless: it rebuilds the partial assignment each call, so it can never desync), so it FUSES with a GF(2) parity theory (`crate::xor_engine::XorEngine`) under one `crate::cdcl::Solver::solve_with`: parity and counting reason together on the shared trail. That is exactly the structure that defeats either alone — e.g. minimal-disagreement parity, a parity core plus a residual cardinality core, where Gaussian elimination handles the parity and cardinality propagation handles the counting, but neither is a refutation by itself. - [struct PbConstraint](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/struct.PbConstraint): A normalized pseudo-Boolean constraint `Σ coeff·lit ≥ degree`: every `coeff > 0`, every variable appears at most once, and the literal sign rides the entry — `(coeff, positive)` with `positive == false` meaning the literal `¬x`. `degree` may be ≤ 0 (then the constraint is trivially true) or exceed the coefficient sum (then it is a contradiction). - [fn coeff_symmetry_generators](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/fn.coeff_symmetry_generators): The coefficient-symmetry generators of a pseudo-Boolean system: adjacent transpositions of variables that share a coefficient profile — the same `(coeff, sign)` (or absence) in every constraint. Such variables are interchangeable because each constraint is a weighted sum, blind to which equal-weight variable carries which value. Each generator is a genuine symmetry (`is_pb_symmetry`); together they generate the full product of symmetric groups on the profile classes. Variables in no constraint are excluded (free, not a constraint symmetry). - [fn is_pb_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/fn.is_pb_symmetry): Does the variable permutation `perm` preserve every constraint? (`term(perm[v]) == term(v)` for all `v` — a relabelling that fixes each constraint’s coefficient/sign structure, hence its solution set.) - [fn php_refutation](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/fn.php_refutation): Refute the pigeonhole principle PHP(`n`, `n−1`) with the classic Cook–Coullard–Turán cutting- plane proof: sum all `n` “each pigeon in ≥1 hole” constraints with all `n−1` “each hole holds ≤1 pigeon” constraints. Every `x` meets its `¬x` and cancels, collapsing the whole system to the trivially-false `0 ≥ 1` in just `2n−1` additions — linear size, where resolution needs exponentially many steps. Returns the final derived constraint (a contradiction). - [fn refute_clausal](https://docs.logicaffeine.com/logicaffeine_proof/pseudo_boolean/fn.refute_clausal): Refute `e` by CUTTING PLANES when it is a cardinality/pigeonhole-shaped CNF. The pairwise encoding loses the cardinality structure, so we RECOVER it: the binary exclusions `¬(a∧b)` form conflict cliques, each a genuine “at most one” group; summing those `at_most(group,1)` cardinality constraints with the positive “at least one” clauses cancels every literal against its negation and collapses a pigeonhole-shaped system to `0 ≥ 1` — POLYNOMIAL, where resolution/CDCL explode. ## logicaffeine_proof::rainbow Rainbow — Jintai Ding & Dieter Schmidt’s multilayer Oil-and-Vinegar signature (ACNS 2005), the multivariate scheme our XL engine is built to attack. This is a faithful reference over GF(2^8): a two-layer central map `F`, invertible affine transforms `S` and `T`, public key `P = S ∘ F ∘ T`, and the Oil-and-Vinegar trapdoor that inverts `F` at signing time. - [struct KeygenInputs](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/struct.KeygenInputs): Inputs for the LOGOS `rainbowKeygen` (the public-map composition `P = S∘F∘T`): the FORWARD affine maps `T`/`S` (recovered by inverting the stored inverses) and the central map, all row-major / packed like `flatten_public`. - [struct PublicKey](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/struct.PublicKey) - [struct RainbowParams](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/struct.RainbowParams): Rainbow layer sizes: `v1` vinegars, then `o1` first-layer oils, then `o2` second-layer oils. - [struct SecretFlat](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/struct.SecretFlat): The secret key flattened for the LOGOS `rainbowSign`: the central map in the same per-output layout as `flatten_public`, plus the affine inverses `S⁻¹` / `T⁻¹` (row-major) and their shifts. - [struct SecretKey](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/struct.SecretKey) - [fn flatten_keygen](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.flatten_keygen) - [fn flatten_public](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.flatten_public): Flatten the public key into three byte arrays for a coefficient-driven verifier: `pubq` holds the upper-triangular quadratic coefficients per output (order `i ≤ j`), `publin` the linear coefficients, `pubc` the constants. This is the exact layout the LOGOS `rainbowVerify` consumes. - [fn flatten_secret](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.flatten_secret) - [fn forge_system](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.forge_system): The MQ system a forger must solve — `P_k(x) − d_k = 0` for every output — handed straight to `crate::xl::xl_solve`. A solution is a signature forgery produced with NO secret key. - [fn keygen](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.keygen) - [fn sign](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.sign): Sign a message hash (`m` field elements). Returns the signature `x ∈ GF(256)^n`, or `None` if the Oil-and-Vinegar inversion kept hitting singular systems (astronomically unlikely). - [fn sign_with_vinegars](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.sign_with_vinegars): Sign with the `v1` vinegar values supplied explicitly (deterministic; `None` if they make a layer’s linear system singular). This is the exact core the LOGOS `rainbowSign` mirrors. - [fn verify](https://docs.logicaffeine.com/logicaffeine_proof/rainbow/fn.verify): Verify a signature: evaluate every public polynomial at `x` and compare to the message hash. ## logicaffeine_proof::register_alloc Certified linear-scan register allocation — the matching/Hall reasoner as a compiler back-end. - [struct LiveRange](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/struct.LiveRange): A variable’s live range over instruction positions `[start, end)`. - [enum Allocation](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/enum.Allocation): The result of allocating physical registers to a basic block. - [fn allocate](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/fn.allocate): Allocate `registers` physical registers to a basic block’s `ranges`, or certify that spilling is unavoidable. O(n log n) via the interval sweep. - [fn is_spill_certificate](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/fn.is_spill_certificate): Re-check a spill certificate: the listed variables pairwise interfere (are mutually live) and number more than `registers` — so they cannot all reside in registers at once. - [fn is_valid_allocation](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/fn.is_valid_allocation): Re-check an allocation: every variable is assigned a register `< registers`, and no two simultaneously-live variables share one. - [fn register_pressure](https://docs.logicaffeine.com/logicaffeine_proof/register_alloc/fn.register_pressure): The register pressure of a block: the most variables live at once (the fewest registers needed). ## logicaffeine_proof::relax_replay Settled-answer replay — the residual certificate for physics-solved linear systems. - [struct IsingClaim](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/struct.IsingClaim): The Ising candidate’s neutral claim: the instance, the returned spins, the claimed exact energy, and the claimed 1-flip stability verdict. BY DESIGN there is no optimality field — a soft-spin settle returns an attractor, and this type cannot express more. - [struct MinimizeClaim](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/struct.MinimizeClaim): The neutral claim a convex-quadratic settle emits: `minimize ½xᵀQx + bᵀx`, the settled readout, a claimed strong-convexity parameter, and a claimed suboptimality bound. Everything exact; nothing trusted. - [struct RelaxClaim](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/struct.RelaxClaim): The neutral claim a settling run emits. Everything exact; nothing trusted. - [fn check_ising_claim](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/fn.check_ising_claim): Judge an Ising candidate: recompute the exact energy and the exact 1-flip stability with this crate’s own arithmetic and demand agreement with BOTH claims. Fail-closed on shape garbage (asymmetry, nonzero diagonal, non-±1 spins). - [fn check_minimize_claim](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/fn.check_minimize_claim): Judge a minimize claim by THEOREM, not trust: for symmetric Q with spectrum ≥ μ > 0 (verified against the exact Gershgorin row bound, which this checker recomputes itself), strong convexity gives `f(x̂) − f* ≤ ‖∇f(x̂)‖² / (2μ)` — the gradient is re-derived with this crate’s own arithmetic and the inequality checked exactly. Fail-closed throughout. - [fn check_relax_claim](https://docs.logicaffeine.com/logicaffeine_proof/relax_replay/fn.check_relax_claim): THE judge. Recomputes the residual with this crate’s own exact multiplication and checks the declared bound. Rejects malformed claims outright. ## logicaffeine_proof::revgate Certify reversible logic gates as bijections. - [enum GateCert](https://docs.logicaffeine.com/logicaffeine_proof/revgate/enum.GateCert): A reversibility certificate for a functional unit. - [fn certify_gate](https://docs.logicaffeine.com/logicaffeine_proof/revgate/fn.certify_gate): Certify an `n`-bit functional unit from its truth table (`table[input] = output`, each a state index `0..2ⁿ`). Reversible iff the table is a permutation; returns the inverse gate, or the first erasing collision that proves it is not. - [fn certify_linear](https://docs.logicaffeine.com/logicaffeine_proof/revgate/fn.certify_linear): Certify a purely-LINEAR `n`-bit block reversible: its GF(2) transfer matrix (`rows[v]` a bitmask of which input bits XOR into output bit `v`) must be invertible (`∈ GL(n,2)`), giving a linear inverse. This is the fast path for CNOT-only (XOR) datapaths. - [fn cnot](https://docs.logicaffeine.com/logicaffeine_proof/revgate/fn.cnot): CNOT (2-bit): `(a,b) ↦ (a, a⊕b)`, state encoded `a | b<<1`. The universal reversible XOR generator — `RevXor` lifted to a gate. - [fn fredkin](https://docs.logicaffeine.com/logicaffeine_proof/revgate/fn.fredkin): Fredkin / CSWAP (3-bit): swap `b` and `c` when `a = 1`. Conserves 1-count; self-inverse. - [fn toffoli](https://docs.logicaffeine.com/logicaffeine_proof/revgate/fn.toffoli): Toffoli / CCNOT (3-bit): `(a,b,c) ↦ (a, b, c⊕(a∧b))`. The universal reversible AND generator. ## logicaffeine_proof::rule_search `aesop`-style rule-set search: turn `auto`’s fixed cascade into an extensible, best-first search over registered rules. - [struct Rule](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/struct.Rule): A search rule: a named tactic with a role and a safety classification. - [struct RuleSet](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/struct.RuleSet): An extensible collection of search rules. - [struct SearchStats](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/struct.SearchStats): What the search explored. - [enum RuleKind](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/enum.RuleKind): The role a rule plays (currently advisory metadata for ordering/diagnostics; the tactic itself encodes the actual transformation). - [enum Safety](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/enum.Safety): How a rule participates in search. - [fn default_ruleset](https://docs.logicaffeine.com/logicaffeine_proof/rule_search/fn.default_ruleset): The default rule set: `auto` as the sole unsafe fallback — so a default `search` closes exactly what `auto` closes, the regression baseline. ## logicaffeine_proof::rup The RUP (Reverse Unit Propagation) linear checker — the fast default trust tier. - [enum Verdict](https://docs.logicaffeine.com/logicaffeine_proof/rup/enum.Verdict): A certified propositional entailment verdict. - [fn check_refutation](https://docs.logicaffeine.com/logicaffeine_proof/rup/fn.check_refutation): Verify a DRAT/LRAT-style refutation: every learned clause is RUP w.r.t. the database built so far, and the full database is then refuted by unit propagation (the empty clause is RUP). Returns `false` if any step does not check — so a corrupted or bogus trace is rejected. - [fn entails_certified](https://docs.logicaffeine.com/logicaffeine_proof/rup/fn.entails_certified): Decide `premises ⊨ goal` with the CDCL solver and independently certify an `Entailed` verdict by RUP replay. `None` if the problem is not purely propositional over recognisable atoms, OR if the solver claims UNSAT but the checker cannot confirm it (a solver bug — fail closed, never report a false `Entailed`). - [fn entails_certified_prepared](https://docs.logicaffeine.com/logicaffeine_proof/rup/fn.entails_certified_prepared): Certify `prepared ⊨ goal` against a premise CNF clausified ONCE by `Cnf::from_premises`. Solving a whole puzzle this way pays the of-pair Tseitin cost a single time, then each cell only adds its `¬goal` unit — the incremental win. ## logicaffeine_proof::sat Propositional SAT-discharge of a `ProofExpr` obligation — the engine behind in-browser, Z3-free hardware proving. - [enum EquivOutcome](https://docs.logicaffeine.com/logicaffeine_proof/sat/enum.EquivOutcome): The result of an equivalence query between two formulas. - [enum ModelOutcome](https://docs.logicaffeine.com/logicaffeine_proof/sat/enum.ModelOutcome): The result of a satisfiability query over a propositional obligation. - [enum UnsatOutcome](https://docs.logicaffeine.com/logicaffeine_proof/sat/enum.UnsatOutcome): The result of an unsatisfiability query — the shared primitive behind equivalence, bounded model checking, k-induction, and vacuity. - [fn decode_model](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.decode_model): Decode a SAT `model` back to `(atom, value)` bindings for every source atom appearing in `exprs` (Tseitin auxiliaries carry no source meaning and are skipped), sorted by name. - [fn decode_model_from](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.decode_model_from): Decode a SAT `model` from a pre-extracted atom→variable map (the table `Cnf` already holds), so a solve need not clone the whole clause database just to read its model back. Equivalent to `decode_model` for the propositional atoms `collect_atoms` gathers. - [fn find_model](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.find_model): Is `e` satisfiable? Returns a witnessing model over its atoms if so. - [fn prove_equivalence](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.prove_equivalence): Are `a` and `b` equivalent? `F ≡ S` iff `F ↔ S` is valid, i.e. `¬(F ↔ S)` is UNSAT. - [fn prove_unsat](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.prove_unsat): core for equivalence, bounded model checking, k-induction, and vacuity. - [fn prove_unsat_certified](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.prove_unsat_certified): Refute `e` with the certified recursive symmetry breaker and return the proof. Each round re-detects the residual automorphism group, certifies ONE lex-leader lead clause as a PR step (its generator a fresh automorphism of the current database), and re-detects — looping to a fixpoint that breaks the COMPLETE group, not just the adjacent positive-row swaps `crate::symmetry::break_symmetries` sees. The returned stream is the certified PR breaks followed by the closing RUP learned clauses, and it is already `check_pr_refutation`-verified against `e`’s CNF. `None` if `e` is not CNF-assertable, is satisfiable, or the breaker did not certify a refutation — the wired, checkable companion of `prove_unsat`’s coarse verdict. - [fn prove_unsat_certified_cnf](https://docs.logicaffeine.com/logicaffeine_proof/sat/fn.prove_unsat_certified_cnf): `prove_unsat_certified` for a CNF the caller has ALREADY built — the seam for a producer that clausifies something other than a `ProofExpr` tree (a bit-blaster asserting a shared gate DAG, whose tree form is exponentially larger than the circuit). Same refutation, same steps: the certificate is a function of the clause set, never of how it was spelled. ## logicaffeine_proof::satcli The SAT command-line driver shared by `logos-sat` and `largo sat`. - [fn main](https://docs.logicaffeine.com/logicaffeine_proof/satcli/fn.main): The `logos-sat` process: `logos-sat [proof.drat]`, with `LOGOS_STATS` for solver statistics. `src/bin/logos-sat.rs` is exactly this call, and so is the test crate’s `logos-sat-under-test`. - [fn run](https://docs.logicaffeine.com/logicaffeine_proof/satcli/fn.run): Run the solver on `input`, writing the solution to `out` and comments / diagnostics to `err`. When `proof_path` is given and the verdict is UNSAT, an exportable certificate is written there. `stats` prints a `c stats …` line to `err`. ## logicaffeine_proof::sdcl Satisfaction-Driven Clause Learning (Heule, Kiesl & Seidl) — the engine that reasons at the Extended-Frege level by discovering propagation-redundant clauses, not just learning implied ones. It is symmetry breaking taken to its limit: where certified symmetry breaking needs an automorphism to supply a witness, SDCL finds the witness by solving the positive reduct — a smaller SAT problem — so it works on any structure, symmetric or not. - [enum CertifiedOutcome](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/enum.CertifiedOutcome): The verdict of the unified certified solver. - [fn find_pr_clause](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/fn.find_pr_clause): From a “stuck” partial assignment `alpha` (its true-literals), try to discover a PR clause `C = ¬alpha` that blocks it, via the positive reduct. Returns the clause and its witness, both verified by the PR checker (fail-closed). This is the SDCL primitive — a universal, automorphism-free generalization of certified symmetry breaking. - [fn find_pr_clause_unified](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/fn.find_pr_clause_unified): The unified PR-clause finder: the universal SDCL discovery (positive-reduct assignment witness) PLUS the scalable symmetry path (substitution witnesses from the supplied generators). The assignment witness is general but can fail to certify at scale (it needs `F|α` UP-refutable); a substitution witness from a live automorphism certifies the lead clauses at any size via an immediate conflict. Trying both gives SDCL that discovers AND scales. - [fn plain_cdcl_refutation](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/fn.plain_cdcl_refutation): A plain CDCL refutation of `clauses` as RUP proof steps — always re-checkable. The certified fallback that guarantees `solve_certified` and `sdcl_refute` never emit an unchecked proof, and the universal source of a `cake_lpr`-checkable LRAT certificate for any UNSAT instance. - [fn sdcl_refute](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/fn.sdcl_refute) - [fn solve_certified](https://docs.logicaffeine.com/logicaffeine_proof/sdcl/fn.solve_certified): The unified certified solver. Root unit propagation first tries to establish a model, checked against every original clause. Otherwise SDCL discovers propagation-redundant clauses through positive reducts and live symmetry, then CDCL solves the augmented formula. UNSAT returns an independently checked refutation; SAT returns a model of the original input. ## logicaffeine_proof::seq_equiv Sequential equivalence by unrolling: a pipelined circuit proven equal to its combinational reference at its latency, or two pipelines of different depths proven to compute the same transaction. - [struct InductionCertificate](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/struct.InductionCertificate): The proof that two circuits agree at every clock from reset: an invariant of register literal pairs true at reset, each pair’s next values proven equal assuming the invariant (one proof a pair, in order), and each output pair proven equal assuming it (one proof an output, in the product’s order, absent for an output pair that is one literal). - [struct Product](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/struct.Product): Two sequential circuits run side by side: inputs of the same name shared, every register of each with its initial value, each named output of the left paired with the right’s, and an output a pair’s difference. - [struct SeqOptions](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/struct.SeqOptions): How `always_equal` searches. - [struct SeqReport](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/struct.SeqReport) - [struct Trace](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/struct.Trace): An assignment from reset under which a pair of outputs differs at the last clock: the registers that start free, by index of the product’s registers (the others are read from their initial values), and the inputs of each clock. - [enum SeqVerdict](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/enum.SeqVerdict) - [fn aligned](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.aligned): Whether `left`’s outputs at clock `left_latency` equal `right`’s at clock `right_latency`, as functions of the clock-0 inputs they share by name, for every initial state of each and every later input. - [fn aligned_by_fraig](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.aligned_by_fraig): `aligned`, decided by `crate::fraig`. - [fn aligned_pair](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.aligned_pair): The two combinational circuits `aligned` decides between: each side at its latency, its free initial values named apart from the other’s (`latch@init.left`, `latch@init.right`). - [fn always_equal](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.always_equal): Whether the two circuits’ outputs agree at every clock from reset. - [fn at_latency](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.at_latency): The outputs at clock `latency` as a combinational graph over the clock-0 inputs (by their own names), the later clocks’ inputs and the free initial values. - [fn check_always](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.check_always): Whether `cert` proves the product’s outputs equal at every clock from reset. - [fn latency_equivalent](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.latency_equivalent): Whether `pipeline`’s outputs at clock `latency` equal the combinational `reference` over the clock-0 inputs. - [fn latency_equivalent_by_fraig](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.latency_equivalent_by_fraig): `latency_equivalent`, decided by `crate::fraig`. - [fn product](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.product): The two circuits as one `Product`. - [fn replays](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.replays): Whether `trace`, run on the product from reset, ends at a clock where some output pair differs. - [fn unroll](https://docs.logicaffeine.com/logicaffeine_proof/seq_equiv/fn.unroll): The graph unrolled over `frames` clocks, the latches’ starting values from their initial values, the outputs of every clock named `name@k`. ## logicaffeine_proof::simp `simp` rule sets: oriented rewrite rules compiled from proved lemmas, indexed for fast lookup, instantiated by matching. - [struct SimpSet](https://docs.logicaffeine.com/logicaffeine_proof/simp/struct.SimpSet): An indexed set of simp rules. ## logicaffeine_proof::solve Structure-detecting solve front-end — the auto-dispatcher that puts our whole arsenal behind a single entry point. - [struct Solved](https://docs.logicaffeine.com/logicaffeine_proof/solve/struct.Solved): A decided instance. - [struct SymmetricCount](https://docs.logicaffeine.com/logicaffeine_proof/solve/struct.SymmetricCount): The solution set described up to symmetry: one representative per orbit, plus the exact total. - [struct SymmetryProfile](https://docs.logicaffeine.com/logicaffeine_proof/solve/struct.SymmetryProfile): The structural profile of a formula’s variable-symmetry group — `|Aut|`, the orbit/rank/transitivity ladder, primitivity, and block structure. The data a surfacing layer (e.g. a Studio panel) needs to explain why an instance is symmetric. - [enum Answer](https://docs.logicaffeine.com/logicaffeine_proof/solve/enum.Answer): The verdict; a model on SAT, with any UNSAT certificate carried in `Solved::proof`. - [enum EquivVerdict](https://docs.logicaffeine.com/logicaffeine_proof/solve/enum.EquivVerdict): The verdict of a symmetry-reduced equivalence check. - [enum Route](https://docs.logicaffeine.com/logicaffeine_proof/solve/enum.Route): Which engine decided the instance. - [fn almost_symmetry_pairs](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.almost_symmetry_pairs): The almost-symmetries (variable transpositions) of a CNF: pairs `(a,b)` whose swap preserves all but at most `max_broken` clauses. Returns each pair with the broken images `σ(B) = { swap(c) : swap(c) ∉ F }` — the clauses that must hold for the swap to map a model to a model, i.e. the guard. An empty image set is a true (syntactic) symmetry and is excluded. - [fn assignment_weight_inventory](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.assignment_weight_inventory): The weight inventory of a formula’s variable symmetry: entry `w` is the number of essentially- distinct (modulo symmetry) `{0,1}` assignments to the variables with exactly `w` ones — the weighted Pólya refinement of `SymmetryProfile::assignment_orbits` (which is the sum). `None` when the group is too large to enumerate. - [fn association_scheme_eigenmatrix](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.association_scheme_eigenmatrix): The eigenmatrix (P-matrix) of the association scheme of a formula’s variable symmetry — the scheme’s “character table”. The coherent configuration (`coherent_configuration_constants`) yields a commutative algebra spanned by the relation matrices `A_i` (`A_i A_j = Σ_k a_{ijk} A_k`); its intersection matrices `B_i` (`B_i[k][j] = a_{ijk}`) commute and are simultaneously diagonalizable, and `P[m][i]` is the eigenvalue of `A_i` on the `m`-th common eigenspace. Computed exactly over a `GF(p)` chosen (by search) so the algebra splits — Dixon’s method applied to the scheme. Returns `(prime, P)`. - [fn association_scheme_multiplicities](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.association_scheme_multiplicities): The multiplicities of the association scheme — the dimensions `m_j` of the common eigenspaces of the relation matrices in the full `|X|`-dimensional space; the “degrees” of the scheme, dual to the valencies. From the eigenmatrix `P` (#eigenmatrix) and the scheme orthogonality relation `m_j = |X| / Σ_i P[j][i]·P[j][ī]/k_i` (`k_i` = valency, `ī` = transpose relation). Computed exactly over a `GF(p)` chosen to split the algebra AND exceed `|X|` (so the small positive integer `m_j ≤ |X|` decodes uniquely). Returns the multiplicities sorted ascending. - [fn automorphism_group_order](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.automorphism_group_order): The order of `Aut(G)` for a formula’s variable-symmetry group `G` — the automorphism group of the symmetry itself. `None` when out of range. - [fn break_all_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.break_all_symmetry): Iterated symmetry breaking to a fixpoint — the automated breaker. Repeatedly detect the formula’s variable symmetry and break each generator with one sound lex constraint — `x_v ≤ x_{g[v]}` at `g`’s least moved point `v` (`v < g[v]`, and the lex-minimum of `g`’s orbit satisfies it, so it keeps ≥ 1 model per orbit, no auxiliary variables) — then re-detect on the strengthened formula, so symmetry that earlier breaks expose is broken in its turn. It runs until a round adds no new constraint: the symmetry “broken to conclusion.” Sound: every clause breaks a genuine symmetry of the current formula, so each round is equisatisfiability-preserving and the whole is equisatisfiable with the input. Returns the original clauses plus the accumulated breaks; the residual variable-symmetry group has shrunk (to trivial when single-bit breaks suffice). Solve the result with `solve_comprehensive`. - [fn break_all_symmetry_complete](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.break_all_symmetry_complete): Complete symmetry breaking — the breaker driven all the way to a single representative per orbit. Detect the full variable-symmetry group and add the COMPLETE lex-leader (one `a ≤_lex a∘g` per group element, via the standard lex-chain auxiliaries), which admits exactly one model per symmetry orbit when the group is enumerable. Returns the strengthened clauses and the new variable count (originals + auxiliaries). Sound (equisatisfiable with the input); complete for groups up to the enumeration cap, and a sound partial break (generators ∪ coset representatives) for larger ones. Unlike `break_all_symmetry` (aux-free, complete only for fully-symmetric orbits), this leaves no residual orbit symmetry. - [fn burnside_ring_product](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.burnside_ring_product): The Burnside ring multiplication of a formula’s variable-symmetry group — `N[a][b][l]`, the decomposition of the product G-set `(G/H_a)×(G/H_b)` into transitive G-sets (the G-set analogue of the character table’s fusion ring). `None` when the subgroup lattice is out of range. - [fn canonical_form](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.canonical_form): The canonical form of a formula’s variable structure, computed by individualization–refinement (the algorithm behind nauty/saucy/bliss). It is an isomorphism invariant: two formulas equal up to a variable permutation that preserves the clause structure have the same canonical form, and — since I-R is complete — two that are not get different canonical forms (so it decides isomorphism exactly, unlike Weisfeiler–Leman). Built on `color_refinement` as its refinement step. `None` if the search exceeds its node budget (gate to moderate `num_vars`). - [fn character_table](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.character_table): The character table of a formula’s variable-symmetry group, computed exactly over a finite field by the Burnside–Dixon algorithm (degrees + `GF(p)`-valued irreducible characters). The deepest structural view of the symmetry — `None` when the group is too large for the finite-field diagonalisation. - [fn class_algebra_constants](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.class_algebra_constants): The class-algebra structure constants of a formula’s variable-symmetry group — `a[i][j][k]`, the multiplication coefficients of the conjugacy classes (`Cᵢ·Cⱼ = Σₖ a[i][j][k]·Cₖ`), the foundation of the character table. `None` when the group is too large to enumerate. - [fn coherent_configuration_constants](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.coherent_configuration_constants): The coherent configuration (association scheme) that 2-WL stabilizes into: its `d` basis relations (the stable pair-color classes `R_0,…,R_{d-1}`) and their intersection numbers `p[i][j][k] = |{z : (x,z) ∈ R_i and (z,y) ∈ R_j}|` for any `(x,y) ∈ R_k`. Returns `(d, p)`. - [fn coherent_rank](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.coherent_rank): The rank of the coherent configuration — the number of basis relations (`d`), the dimension of the coherent algebra. Equal to `two_wl_pair_cells`; for a group’s orbital configuration it is the orbital rank. `None` when the configuration is out of range / not coherent. - [fn color_refinement](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.color_refinement): Color refinement (1-dimensional Weisfeiler–Leman) of a formula’s variable–clause incidence graph — the coarsest equitable partition of the variables, computed in polynomial time. Variables and clauses are coloured (clauses initialised by width); each round recolours a clause by the sorted multiset of its incident `(variable colour, sign)` pairs and a variable by the sorted multiset of its incident `(clause colour, sign)` pairs, to a fixpoint. The result `cell[v]` is the variable’s colour. - [fn color_refinement_cells](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.color_refinement_cells): The number of cells in the color-refinement (equitable) partition — a cheap polynomial symmetry indicator. At most the number of variable orbits (`cells ≤ orbits`, since each cell is a union of orbits). - [fn common_automorphism_generators](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.common_automorphism_generators): The common variable automorphisms of two formulas — phase-free permutations `σ` with `σ(F)=F` AND `σ(S)=S`, a generating set for a subgroup of `Aut(F) ∩ Aut(S)`. Detected from each formula’s own automorphisms and then VERIFIED against both clause sets, so every returned generator is a genuine common automorphism (a wrong one can never slip through). This is the group under which a disagreement between `F` and `S` is symmetric: if `σ` fixes both, then `F` and `S` disagree at `a` iff they disagree at `σ(a)` — so equivalence checking can be reduced along its orbits. - [fn equivalence_check_counts](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.equivalence_check_counts): `(checks_with_symmetry, naive_checks)` — the number of entailment checks the symmetry reduction performs (one per clause-orbit, both directions) versus the naive per-clause count. Equal when there is no usable common symmetry; strictly smaller when the shared automorphism group fuses clauses into orbits. - [fn equivalent_modulo_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.equivalent_modulo_symmetry): Logical equivalence `F ≡ S`, symmetry-reduced. `F ≡ S` iff `F ⊨ S` and `S ⊨ F`, and `F ⊨ S` iff `F` entails every clause of `S`. The key reduction: for a common automorphism `σ ∈ Aut(F) ∩ Aut(S)`, `F ⊨ C ⟺ F ⊨ σ(C)` (a model of `F ∧ ¬C` maps under `σ` to a model of `F ∧ ¬σ(C)`), so it suffices to check one clause per orbit of `S`’s clauses under the common symmetry (and dually for `F`). The verdict is unchanged from the naive check — only the work shrinks — and a `Differ` witness is a concrete, re-checkable disagreement (it satisfies one formula and violates a clause of the other). This is the symmetry-aware companion to `crate::sat::prove_equivalence`. - [fn formulas_isomorphic](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.formulas_isomorphic): Whether two formulas over the same variables are isomorphic — equal up to a variable permutation preserving the (signed) clause structure — by comparing their canonical forms. `None` if either canonical form exceeds the search budget. - [fn fractional_automorphism](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.fractional_automorphism): A fractional automorphism of a formula: a doubly-stochastic matrix `B` commuting with the variable co-occurrence matrix `A` (`BA = AB`) — the LP relaxation of an automorphism (a permutation matrix commuting with `A`). The canonical one is block-averaging over the coarsest equitable partition (`equitable_partition_of`): `B[u][v] = 1/|cell(u)|` if `u,v` share a cell, else `0`. By Tinhofer’s theorem it commutes with `A` iff the partition is equitable, and it is non-trivial (not a permutation) exactly when the partition is non-discrete — i.e. exactly when the formula has non-trivial 1-WL symmetry. - [fn frobenius_schur_indicators](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.frobenius_schur_indicators): The Frobenius–Schur indicators of a formula’s variable-symmetry group — `+1`/`0`/`−1` per irreducible (real/complex/quaternionic), the finest representation-theoretic refinement of the symmetry (it separates groups even when the character table cannot). `None` when out of range. - [fn galois_class_orbits](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.galois_class_orbits): The Galois orbits on conjugacy classes of a formula’s variable symmetry — classes fused by the `(ℤ/e)*` action `C ↦ C^t` (algebraic conjugacy). The singletons are the rational classes. `None` when out of range. - [fn generating_tuple_count](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.generating_tuple_count): The number of ordered `k`-tuples of symmetries that generate the whole variable-symmetry group `G` (Hall’s Eulerian function `e_k(G)`); `e_k(G)/|G|^k` is the probability `k` random symmetries generate it. `None` when out of range. - [fn is_fractional_automorphism](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.is_fractional_automorphism): Verify that block-averaging over `partition` gives a doubly-stochastic matrix `B` commuting with the co-occurrence matrix `A`. `B` is doubly-stochastic by construction (each row/column sums to 1), so this checks `BA = AB`, which holds iff `partition` is equitable — the exact (integer) certificate. The identity `(1/|cell(u)|)·Σ_{x∈cell(u)} A[x][w] = (1/|cell(w)|)·Σ_{x∈cell(w)} A[u][x]` is verified cross-multiplied. - [fn isotypic_multiplicities](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.isotypic_multiplicities): The isotypic decomposition of a formula’s variable-permutation representation — the multiplicity of each irreducible in `π = Σ_s m_s χ_s`. The representation-theoretic spectrum of the symmetry, tying the character table back to the orbit/orbital structure of the action. `None` when out of range. - [fn mine_clauses](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.mine_clauses): The clause-bundle pass. Run every structure-mining contributor and union the implied clauses (no-goods) they discover. Each contributor’s soundness contract: every returned clause is implied by the formula, so the union preserves the solution set — a sound, never-worse enrichment that lets one method’s discovered structure accelerate the others (and CDCL). Contributors that find nothing are cheap, so this is safe to run before the fallback on any instance. - [fn mobius_number](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.mobius_number): The Möbius number `μ(1, G)` of the subgroup lattice of a formula’s variable-symmetry group. `None` when the subgroup lattice is out of range. - [fn models_up_to_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.models_up_to_symmetry): Enumerate the solution set up to symmetry, and count it exactly. Find a model (via the full arsenal), record it as an orbit representative, then BLOCK its entire symmetry orbit and repeat until unsatisfiable. Because every orbit is removed in one step, the representatives are the essentially- distinct solutions and the exact model count is the sum of the orbit sizes — so an instance with `2^Θ(n)` models is counted by enumerating only its (far fewer) orbits. Sound: each representative is a re-checked model, each orbit a genuine set of models (the generators are automorphisms), so the orbits partition the model set. The representative count agrees with Burnside (`crate::sym_break::count_models_modulo_symmetry`) — two independent routes to the orbit count. - [fn optimization_symmetry_generators](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.optimization_symmetry_generators): The symmetries of an optimization problem `(F, weights)`: variable automorphisms of `F` that also preserve the objective (`weights[g[v]] = weights[v]` for all `v`). Under such a `σ` the objective is constant on orbits, so every optimal model’s whole orbit is optimal — the group along which the optimum may be symmetry-reduced. Verified against both `F` and the weights, so every generator is genuine. - [fn optimize_enumeration_counts](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.optimize_enumeration_counts): `(models_with_symmetry, models_without_symmetry)` — how many candidate models the optimizer enumerates with the symmetry break versus the naive enumeration. Equal with no usable symmetry, smaller when the objective-preserving group fuses optimal (and non-optimal) models into orbits. - [fn optimize_modulo_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.optimize_modulo_symmetry): Weighted minimization, symmetry-reduced. Minimise `Σ weights[i]·x_i` over the models of `clauses`, exploiting `optimization_symmetry_generators`: break the objective-preserving symmetry, then search the reduced model space. SOUND — the optimum is identical to the unbroken problem (an optimal orbit’s lex-leader survives the break and has the same objective) and the witness is a genuine model of the original `F`. `None` iff `F` is unsatisfiable. The symmetry-aware optimizer (a new problem class beyond the decision/counting/equivalence faces). - [fn pb_symmetry_profile](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.pb_symmetry_profile): The `SymmetryProfile` of a pseudo-Boolean system’s coefficient-symmetry group — variables that share a coefficient profile across all constraints (`crate::pseudo_boolean::coeff_symmetry_generators`) — read through the same structural ladder as `symmetry_structure`. The symmetry of weighted constraints, surfaced exactly like the clause-structure symmetry. - [fn permutation_character](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.permutation_character): The permutation character `π(g) = #fixed variables of g` of a formula’s variable-symmetry action, valued per conjugacy class. The character of the representation the symmetry group carries on the variables themselves. `None` when the group is too large to enumerate. - [fn permutation_character_decomposition](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.permutation_character_decomposition): The permutation-character decomposition of a formula’s variable-symmetry group — the bridge between its table of marks and its character table. `M[i][s]` is the multiplicity of irreducible `χ_s` in the permutation representation on the cosets `G/H_i` (Frobenius reciprocity). Returns `(subgroup_orders, irreducible_degrees, M)`. `None` when out of range. - [fn provably_asymmetric_variables](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.provably_asymmetric_variables): The variables that color refinement places in a singleton cell — provably fixed by every (phase-free) automorphism, since `orbit(v) ⊆ cell(v)` and `|cell(v)| = 1` forces `|orbit(v)| = 1`. A polynomial certificate of asymmetry: these variables can be skipped entirely when detecting or breaking symmetry. - [fn semantic_symmetry_pairs](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.semantic_symmetry_pairs): The semantic symmetries (variable transpositions) of a CNF: pairs `(a,b)` whose swap preserves the MODEL SET, `F ≡ swap(F)`, even when it does NOT preserve the clause set. Checked by implication: `F ⊨ swap(F)` (and, by the involution `swap² = id`, that is full equivalence). Returns the semantic pairs and whether any is non-syntactic (clause set changed) — i.e. genuinely beyond what the syntactic detector (`crate::sym_break::variable_automorphism_generators`) can see. - [fn solve_by_components](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.solve_by_components): Decide via plain component decomposition as a public dispatcher route: split into independent components and solve each apart through the full arsenal, combining the verdicts. A single component (or a model that fails the fail-closed recheck) defers to the plain CDCL fallback. - [fn solve_by_symmetry_breaking](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.solve_by_symmetry_breaking): Solve by breaking all symmetry first — the breaker as a front-end. Run the aux-free recursive breaker (`break_all_symmetry`) to collapse the symmetry to its fixpoint, then decide the reduced formula with the full arsenal (`solve_comprehensive`). Equisatisfiable, so the verdict is the original’s, and any returned model satisfies the original clauses (a subset of the broken set) — re-checked fail-closed. (Uses the aux-free reducer, not `break_all_symmetry_complete`: CDCL handles the residual cheaply, and the complete lex-leader of a large group would be far more expensive than the search it saves.) - [fn solve_comprehensive](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.solve_comprehensive): The full arsenal in one call — the opt-in power-mode solver. Runs the cheap specialists (`structured_prefix`); then, before the exponential CDCL fallback, the heavier engines the fast path skips: bounded-degree Nullstellensatz / Polynomial Calculus (the nonlinear algebraic refutation, `crate::polycalc`) and complete lex-leader symmetry breaking (`crate::sym_break`: the whole automorphism group from the Schreier–Sims backend, feeding CDCL a one-model-per-orbit formula). Slower than `solve_structured` (it may run Nullstellensatz and automorphism detection), so it is the maximum-power entry, not the default. Always correct — the CDCL fallback is complete. - [fn solve_structured](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.solve_structured): Decide `clauses` over `num_vars` variables, routing through every cheap specialist before CDCL — the fast default front-end. For the full arsenal (heavy algebraic + complete symmetry breaking before the fallback) use `solve_comprehensive`. - [fn solve_with_declared_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.solve_with_declared_symmetry): The full arsenal with caller-DECLARED symmetry. The modeler often knows symmetries the automatic detector cannot afford to find (geometric, semantic, or simply large). This entry point accepts declared variable-permutation generators, verifies each is a genuine symmetry (`is_declared_symmetry` — never trusting a declaration blindly, so an incorrect one is silently dropped), unions the survivors with the auto-detected symmetry, and breaks the combined group with the lex-leader (complete by enumeration when the group is small, partial over the generators otherwise). Sound: only verified, model-set- preserving permutations enter the break; a SAT model is re-checked, and on any anomaly it falls back to the authoritative `solve_comprehensive`. With no declared and no detected symmetry it simply is `solve_comprehensive`. - [fn structured_prefix](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.structured_prefix): The cheap-specialist chain — every route O(clauses) to apply and reject, so the front-end is never slower than plain CDCL. Returns the decision if a specialist fires, or `None` (the CDCL fallback is needed). Public so callers that only want the O(clauses) specialist verdict — e.g. a per-node cofactor-DAG leaf check — can skip the expensive CDCL search entirely. - [fn symmetry_structure](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.symmetry_structure): Compute the `SymmetryProfile` of `clauses` — detect the variable-symmetry generators and read off the whole structural ladder (order via Schreier–Sims, orbits, orbitals/rank, transitivity, primitivity, blocks). The rank and transitivity rungs are gated to moderate sizes (their tuple spaces grow with the degree); `0` signals “not computed” there. - [fn table_of_marks](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.table_of_marks): The table of marks of a formula’s variable-symmetry group — the Burnside-ring classification of its `G`-sets (the permutation-representation analogue of `character_table`). Returns `(subgroup_class_orders, marks)`. `None` when the subgroup lattice is out of range. - [fn tensor_decomposition](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.tensor_decomposition): The tensor (fusion) decomposition of a formula’s variable-symmetry irreducibles — `N[i][j][k]`, the multiplicity of `χ_k` in `χ_i ⊗ χ_j`, the multiplication table of the representation ring `R(G)`. `None` when the character table is out of range. - [fn three_wl_colors](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.three_wl_colors): 3-dimensional Weisfeiler–Leman (3-WL) of a formula’s variables — color refinement on ordered triples. A triple `(i,j,k)` is initialized by the 2-WL colors of its three pairs `(pc[i][j], pc[i][k], pc[j][k])`, then each round recolored by `(old color, sorted multiset over all w of (color(w,j,k), color(i,w,k), color(i,j,w)))` to a fixpoint. Returns the `n×n×n` color tensor. - [fn three_wl_fingerprint](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.three_wl_fingerprint): The label-independent 3-WL fingerprint: the sorted multiset of triple-color class sizes. Separates strongly-regular graphs that share every 2-WL invariant (the rook’s vs Shrikhande graph). - [fn two_wl_fingerprint](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.two_wl_fingerprint): The label-independent 2-WL fingerprint: the sorted multiset of pair-color class sizes. Two formulas with different fingerprints are provably non-isomorphic (as colored variable structures) — the distinguishing power that separates, e.g., a 6-cycle from two triangles where 1-WL cannot. - [fn two_wl_pair_cells](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.two_wl_pair_cells): The number of distinct 2-WL pair colors — at most the number of orbitals (`pair-cells ≤ orbitals`). - [fn two_wl_pair_colors](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.two_wl_pair_colors): 2-dimensional Weisfeiler–Leman (2-WL) of a formula’s variables — color refinement lifted from vertices to ordered pairs. Each pair `(i,j)` is colored: the diagonal by its 1-WL vertex color, an off-diagonal pair by `(1-WL(i), 1-WL(j), co-occurrence signature)` where the signature is the sorted multiset over clauses containing both of `(clause width, sign of i, sign of j)`. Each round recolors `(i,j)` by `(old color, sorted multiset over all k of (color(i,k), color(k,j)))`, to a fixpoint. - [fn weighted_model_count](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.weighted_model_count): Symmetry-accelerated weighted model counting — the partition function `Z = Σ_{m ⊨ F} W(m)` with literal weights `W(m) = Π_v weight[v].{1 if m[v] else 0}`. The formula’s variable symmetry partitions the models into orbits, so each `solve()` recovers one model, its whole orbit is enumerated and its members’ weights summed, then the entire orbit is blocked — one solve per orbit instead of per model. Exact for ARBITRARY weights (every model’s true weight is summed; the symmetry only groups the search), the symmetry-aware analogue of weighted #SAT / lifted inference. Returns `Z`. - [fn weighted_model_count_solve_counts](https://docs.logicaffeine.com/logicaffeine_proof/solve/fn.weighted_model_count_solve_counts): `(orbit_solves, total_models)` — how many `solve()` calls the symmetry-accelerated weighted count makes (one per model-orbit) versus the number of models. Equal with no usable symmetry, smaller when symmetry fuses models into orbits. ## logicaffeine_proof::sos Sum-of-Squares / Positivstellensatz refutation over ℚ — kept EXACT (no SDP, no floating point) by the LP slice of the cone. True SoS is a semidefinite program over the reals; that would forfeit our certified guarantee. Instead we take the diagonal (fixed-square-basis) Positivstellensatz, which is an exact rational linear program: a CNF is lifted to degree-2 pseudo-Boolean inequalities and the lift is refuted by exact Fourier–Motzkin / Farkas elimination. - [fn check_sos_certificate](https://docs.logicaffeine.com/logicaffeine_proof/sos/fn.check_sos_certificate): Independently re-check an SoS Farkas certificate from `sos_certificate`: recompute the degree-2 lift from the clauses, combine its polynomials with the certificate’s multipliers, and confirm the result cancels every variable and leaves a strictly positive constant — the self-contained contradiction `0 < d ≤ 0`. It shares no arithmetic with the Fourier–Motzkin elimination that produced the certificate, so it is a genuine independent witness of the refutation (the SoS analog of `crate::xorsat::is_refutation`). Fails closed on a negative multiplier, an out-of-range row, an empty certificate, or any residual variable. - [fn sos_certificate](https://docs.logicaffeine.com/logicaffeine_proof/sos/fn.sos_certificate): The Farkas certificate of a degree-2 SoS refutation: the non-negative multipliers over the lift constraints whose combination is a positive constant `≤ 0`. `None` if no degree-2 refutation is found. Re-checkable: combining the lift polynomials with these multipliers yields a bare positive constant. - [fn sos_refutes](https://docs.logicaffeine.com/logicaffeine_proof/sos/fn.sos_refutes): Does a degree-2 Positivstellensatz (diagonal SoS) refutation of the CNF exist over ℚ? Sound: a `true` result is a certified UNSAT. Declines (false) when no degree-2 refutation exists or the instance exceeds `MAX_VARS` / the elimination caps. ## logicaffeine_proof::steenrod The Steenrod algebra acting on `H*(BZ/2; Z/2) = Z/2[x]` — the deepest layer of cohomology operations, and a place where homotopy theory turns out to be number theory. - [enum AdamsFact](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/enum.AdamsFact): One machine-derived fact about the Adams `E₂` chart of the sphere. Every variant is computed from the minimal resolution and its chain-level diagonal — none is asserted. - [fn act_monomial](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.act_monomial): The action of a Steenrod monomial on a class in `H*(BZ/2) = Z/2[x]` (apply the squares right-to-left). - [fn adams_one_line](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.adams_one_line): `dim Ext^{1,t}_𝒜(Z/2, Z/2)` — the first line of the Adams `E₂` page = the indecomposables of the Steenrod algebra in degree `t`. Equals `dim 𝒜_t − dim(𝒜⁺·𝒜⁺)_t`. By Milnor it is `1` exactly when `t` is a power of 2 (the `h_i = Sq^{2ⁱ}`), and `0` otherwise. - [fn adams_two_line](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.adams_two_line): `dim Ext^{2,t}_𝒜(Z/2, Z/2)` — the second line of the Adams `E₂` page: the minimal generators of `ker(d₁)` in degree `t`, i.e. `dim ker(d₁)_t − dim(𝒜⁺·ker(d₁))_t`. The relations among the `Sq^{2ⁱ}`. - [fn adem_reduce](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.adem_reduce): Reduce a Steenrod monomial to its `Z/2` sum of admissible monomials via the Adem relations — the canonical form in the Steenrod algebra. A `HashSet` models the `Z/2` linear combination (present = coefficient 1; re-insertion cancels). - [fn admissibles_of_degree](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.admissibles_of_degree): The admissible monomials of total degree `t` — a basis of the Steenrod algebra `𝒜_t`. - [fn apply_sq](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.apply_sq): Apply a single `Sqⁱ` to a class in `H*(BZ/2; Z/2) = Z/2[x]`: `Sqⁱ(Σ aₖ xᵏ) = Σ aₖ C(k,i) x^{k+i}`. - [fn ext](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.ext): `dim Ext^{s,t}_𝒜(Z/2, Z/2)` — the full Adams `E₂` page from the minimal resolution. - [fn harvest_adams_facts](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.harvest_adams_facts): The self-igniting fact engine: from a single minimal resolution it auto-collects everything the symmetry breaking nets — the chart dimensions, the ring products (multiplying named classes by the indecomposables to a fixpoint, so ring relations surface automatically when two product-paths collide on one generator), the `Sq⁰` doubling across the chart, and the exact 2-local stable stems from the `h₀`-towers. Returns the deduplicated, sorted catalog. Bounded by `(max_s, max_t)`; the doubling reaches through filtration 2 (cup-homotopies `Δ₀..Δ₂`). - [fn harvest_secondary_facts](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.harvest_secondary_facts): Auto-collect the primary chart from a resolution by pure symmetry-breaking — no proving, no chain-level diagonal, so it is cheap and runs to a wide range. Gathers chart dimensions, ring products and the relations that surface by collision, the un-auto-able (secondary/Massey) generators the product sweep cannot name, and the exact 2-local stable stems from the `h₀`-towers. The sorted/deduped catalog. - [fn is_admissible](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.is_admissible): Is a monomial `Sq^{i₁}…Sq^{iₖ}` admissible? (`i_j ≥ 2 i_{j+1}` for all adjacent pairs.) - [fn is_decomposable_sq](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.is_decomposable_sq): Is `Sqⁿ` decomposable — a `Z/2` combination of products `SqᵃSqᵇ` (`a, b ≥ 1`) — in the Steenrod algebra? Decided by reducing every such product to the admissible basis (Adem) and testing whether `Sqⁿ` lies in their span. - [fn monomial](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.monomial): The monomial `xᵏ`. - [fn sq](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.sq): `Sqⁱ(xᵏ)` on `H*(BZ/2; Z/2)` — the coefficient of `x^{k+i}` in `Sq(xᵏ) = (x + x²)ᵏ`. - [fn total_square](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.total_square): The total Steenrod square `Sq`, as the ring endomorphism of `Z/2[x]` sending `x ↦ x + x²` (Cartan formula). Returns `Sq(p)` as a polynomial. - [fn yoneda_product](https://docs.logicaffeine.com/logicaffeine_proof/steenrod/fn.yoneda_product): The Yoneda product `Ext^{a_s,t_a} ⊗ Ext^{b_s,t_b} → Ext^{a_s+b_s, t_a+t_b}` on the cohomology of the Steenrod algebra, computed from the resolution itself. The cocycle dual to generator `(a_s, a_gi)` is lifted to a comparison chain map `φ_•: C_{a_s+•} → C_•` (`ε·φ_0 = dual`, `∂φ_k = φ_{k-1}∂`, each step a `Z/2` boundary solve), and the product is `dual_b ∘ φ_{b_s}` — read off as the `(b_gi, identity)` coefficient. The comparison map is the diagonal `X → X×X` dualized onto the resolution: the geometric symmetry made algebra. Returns the product’s `Z/2` support among the `C_{a_s+b_s}` generators. ## logicaffeine_proof::streams Stream equivalence over units proven apart: two circuits that take a stream of tokens through a valid-ready handshake and give a stream back, each at its own width and its own pace, decided equal token for token under an arrival pattern. - [struct Environment](https://docs.logicaffeine.com/logicaffeine_proof/streams/struct.Environment): The arrival pattern a side runs under, `frames` clocks: whether a token is offered at each clock, whether a given one is taken (or, for a side that never waits, watched for) at each clock, and what every other input is at each clock. Only the handshakes at those clocks are the side’s schedule, so the clocks before a reset settles are left out by offering and taking nothing there. - [struct Ports](https://docs.logicaffeine.com/logicaffeine_proof/streams/struct.Ports): A side’s stream ports, by bit name: the input stream’s valid, ready and data, the output stream’s valid, ready (none for a side that never waits for it) and data; and what bit `bit` of the side’s j-th input token reads (`token(j, bit)`, a symbol the other side’s token reads too). - [struct Report](https://docs.logicaffeine.com/logicaffeine_proof/streams/struct.Report): A decision of two streams: a verdict per claimed output bit (`out.`), each side’s schedule, the units’ rounds, and how many tokens each side gave in the clocks unrolled. - [struct Schedule](https://docs.logicaffeine.com/logicaffeine_proof/streams/struct.Schedule): A side’s schedule under its environment: the clocks it took its input tokens at and gave its output tokens at, and the derivation, from the side unrolled alone, that every handshake is the constant it was taken to be. - [struct StreamSide](https://docs.logicaffeine.com/logicaffeine_proof/streams/struct.StreamSide): One side: its cut circuit, its units, its ports. - [enum StreamError](https://docs.logicaffeine.com/logicaffeine_proof/streams/enum.StreamError): Why two streams cannot be decided. - [fn decide](https://docs.logicaffeine.com/logicaffeine_proof/streams/fn.decide): Decide `left` against `right`, each under its environment, over their units, the functions of `functions` (each a left function, the right one proven equal to it) the only ones identified. - [fn schedule](https://docs.logicaffeine.com/logicaffeine_proof/streams/fn.schedule): A side’s schedule under its environment, every handshake it rests on proven the constant it is. ## logicaffeine_proof::sweep Combinational equivalence: two circuits’ outputs proven equal, or told apart by an input assignment that replays, every equality carried by a lemma whose LRAT proof a small checker re-validates. - [struct Certificate](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Certificate): Lemmas in proof order; a lemma’s query includes the lemmas before it. - [struct CutCost](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.CutCost): The queries put at one kind of cut, their verdicts and what they cost, summed. - [struct Decided](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Decided): `decide`’s verdict for each pair, the certificate behind its equalities, and its cost. - [struct Distinction](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Distinction): A family of circuits told apart by `distinguish`. - [struct Earlier](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Earlier): Lemmas in proof order, each node of one indexed by the lemmas that relate it: the lemmas touching a cone found in time proportional to the cone, not to every lemma, in lemma order. - [struct Hard](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Hard): One query’s cost: the pair, the cut it was put with (empty for the whole cone), its formula’s size and the conflicts its solve took. - [struct Lemma](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Lemma): A proven equivalence `a ≡ b`: its proof refutes `query_with_cut``(a, b, cut, earlier lemmas)`. - [struct Miter](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Miter): Two circuits in one graph: inputs of the same name shared (unnamed and one-sided inputs kept apart), each named output of the left paired with the right’s output of that name, and an output a pair’s difference. - [struct Options](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Options): How `decide` searches. - [struct Progress](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Progress): A report of a long search: `report` is handed the cost so far once every `every` candidates put to the solver. - [struct Query](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Query): A lemma’s formula: variable `k` is the `k`-th node of `cone` (the two literals’ cone, in increasing order), then of `extra` (nodes outside the cone an earlier lemma relates to a node inside it, free, in increasing order). - [struct Report](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Report): A decided miter: a verdict per output name, the certificate behind the equalities, and the search’s cost. - [struct Stats](https://docs.logicaffeine.com/logicaffeine_proof/sweep/struct.Stats): What a decision cost. - [enum MiterError](https://docs.logicaffeine.com/logicaffeine_proof/sweep/enum.MiterError): Why two circuits cannot be paired. - [enum Verdict](https://docs.logicaffeine.com/logicaffeine_proof/sweep/enum.Verdict): What `decide` found for one pair of literals. - [const CUT_DEPTHS](https://docs.logicaffeine.com/logicaffeine_proof/sweep/constant.CUT_DEPTHS): The depths a candidate is first tried at before its whole cone. - [const CUT_KINDS](https://docs.logicaffeine.com/logicaffeine_proof/sweep/constant.CUT_KINDS): The kinds of cut a query is put at: each of `CUT_DEPTHS`, where the cones meet, and none. - [const HARDEST](https://docs.logicaffeine.com/logicaffeine_proof/sweep/constant.HARDEST): How many of the hardest queries `Stats` keeps. - [fn check](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.check): Whether `certificate` proves every claim: each lemma’s proof refutes its query in order, and each claimed pair is one literal, or two literals the lemmas join with matching phase. - [fn decide](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.decide): Decide `a ≡ b` for every pair of literals of `aig`, latches read as free values. - [fn distinguish](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.distinguish): Tell a family of circuits apart: which members compute the same function, each such equality proven and certified (`equivalent`), and input assignments on which every two members that differ give different outputs. The members share input and output names; an input without a name is refused unless no output reads it. Simulation on the vectors so far groups the members by their outputs; within a group each member is put against the group’s first, and an input that separates them (`separating_input`, `budget` conflicts) becomes a vector that splits the group, while none found makes it proven equal. The cover is chosen greedily from the `seeds` and the found vectors, each pick the vector that tells the most pairs of classes apart that no earlier pick does; the table is each class’s outputs there, what names the class of a black box whose outputs on the cover are measured. - [fn equivalent](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.equivalent): Pair `left` and `right` by output name and decide every pair. - [fn miter](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.miter) - [fn query](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.query): `query_with_cut` over the whole cone. - [fn query_with_cut](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.query_with_cut): The Tseitin clauses of the cone of `a` and `b` in node order, a node of `cut` (sorted) left free, then the two clauses of each earlier lemma with a literal in that cone, in lemma order (its other node, when outside the cone, a free variable of its own: lemmas joined through a representative the cone does not reach still join), then `a ≠ b` as `(a ∨ b) ∧ (¬a ∨ ¬b)`. - [fn separating_input](https://docs.logicaffeine.com/logicaffeine_proof/sweep/fn.separating_input): An input assignment on which some pair of `left`’s and `right`’s outputs differ, found by one search over every difference at once and replayed before it is returned, with the miter it is an assignment of; `Ok(None)` when the search shows they never differ. A search, not a certificate: an equality is claimed only by `equivalent`. ## logicaffeine_proof::sym_break Complete lex-leader symmetry breaking, driven by the Schreier–Sims backend. - [fn affine_lex_leader_sbp](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.affine_lex_leader_sbp): The lex-leader SBP for affine maps `α: x ↦ Ax ⊕ b` over GF(2) — the machinery that breaks the affine parity symmetries a variable/literal permutation SBP (`lex_leader_sbp`) structurally cannot express (an image bit is an XOR of several variables, not one literal). Each `maps[k]` is a per-output spec: `maps[k][j] = (A_j, b_j)` with `α(x)[j] = ⊕_{i∈A_j} x_i ⊕ b_j`. Each non-identity output is Tseitin-encoded as a fresh variable, then the standard prefix-equality chain `encode_lex_le` enforces `x ≤_lex α(x)`. Satisfiability-preserving for any model-set affine symmetry (the lex-least model of each orbit survives). Returns the extra clauses and the new total variable count (aux appended above `num_vars`). - [fn conditional_symmetry_generators](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.conditional_symmetry_generators): Conditional (local) symmetry — the symmetry of the RESIDUAL formula after a partial assignment. A formula can be globally asymmetric yet its residual `F|ρ` symmetric: symmetries that emerge only down a branch, invisible to a global automorphism search. Returns the residual’s literal-symmetry generators (image-literal form). This is a different symmetry source — the basis for local symmetry breaking during search, where each decision can unlock fresh symmetry to exploit. - [fn count_models_modulo_symmetry](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.count_models_modulo_symmetry): The number of essentially-distinct solutions — models counted up to the formula’s symmetry: the orbit count of the solution set (`#SAT modulo G`). The complete lex-leader keeps exactly one model per orbit, so counting the symmetry-broken formula’s models is the orbit count. `None` if the symmetry group is too large to enumerate for the complete break. The counting face of symmetry breaking — and, by Burnside, `(1/|G|)·Σ_σ #{models fixed by σ}`. - [fn hierarchical_break](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.hierarchical_break): Hierarchical (block-wise) symmetry breaking. For an imprimitive symmetry — a grid like PHP or graph colouring — the minimal block system splits the variables into equal blocks (e.g. the rows). The adjacent block-swaps (inter-block) and the uniform adjacent within-block swaps (intra-block) are STRUCTURED generators; each is verified to actually lie in the group (`Bsgs::contains`), then their lex-leader is the “sorted blocks, sorted within” break — a POLYNOMIAL set of `O(blocks + block-size)` constraints that breaks the wreath/product symmetry for which the complete enumeration would need `|G|` (exponential) clauses. Sound (it only uses verified group elements). `None` if the group is primitive, has no phase-free symmetry, or no structured generator lies in it. Scope: variable (phase-free) grids. - [fn is_lex_leader](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.is_lex_leader): Is `a` the lexicographic leader of its orbit — `a ≤_lex a∘g` for every `g`? The semantic canonical test; the CNF predicate `lex_leader_sbp` accepts exactly these assignments. - [fn is_lex_leader_lit](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.is_lex_leader_lit): `is_lex_leader` over literal symmetries: `aˢ[j]` is the value of the image literal `img[j]` under `a` (a phase flip negates the compared bit). - [fn lex_leader_sbp](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.lex_leader_sbp): The lex-leader symmetry-breaking predicate as CNF: for every non-identity `g ∈ group`, clauses asserting `a ≤_lex a∘g`. Returns the extra clauses plus the new total variable count (prefix-equality aux variables are appended above `num_vars`). It is satisfiability-preserving for any set of automorphisms (the lex-least model of each orbit always survives). Pass the whole group for the COMPLETE break (exactly one model per orbit), or just a generating set for a sound POLYNOMIAL PARTIAL break that scales to arbitrarily large groups — both keep at least one representative per orbit. - [fn lex_leader_sbp_lit](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.lex_leader_sbp_lit): The lex-leader SBP over literal symmetries (`group[k][j]` = the image literal of variable `j`), which breaks variable and value/phase symmetry alike. As with `lex_leader_sbp`, pass the whole group for the complete break or a generating set for the polynomial partial break. - [fn literal_automorphism_generators](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.literal_automorphism_generators): The literal-permutation automorphism GENERATORS — variable AND value/phase symmetry — as image-literal vectors (`imgⱼ = σ(+xⱼ)`). Unlike `variable_automorphism_generators`, phase flips are kept, so this captures the symmetry of formulas invariant under negating variables. Empty if none. - [fn literal_automorphism_group](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.literal_automorphism_group): The full literal-automorphism group (variable + value symmetry) enumerated via the Schreier–Sims backend on the `2·num_vars` literal points, for the complete break. `None` if `|G| > cap` (use the generators for the polynomial partial break instead). - [fn litsym_from_points](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.litsym_from_points): A permutation of the `2·num_vars` literal points back to a literal symmetry (`img[j]` from where `+xⱼ` goes). Inverse of `litsym_to_points`. - [fn litsym_to_points](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.litsym_to_points): A literal symmetry (`img[j]` = image literal of variable `j`) as a permutation of the `2·num_vars` literal points — for the Schreier–Sims backend (order, enumeration). Negation is respected. - [fn variable_automorphism_generators](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.variable_automorphism_generators): The variable-permutation automorphism GENERATORS of a CNF (phase-free symmetries), without enumerating the group — fast, no size cap. `None` if a detected symmetry flips a phase (a value symmetry this variable scheme does not cover). An empty vector means no non-trivial symmetry. - [fn variable_automorphism_group](https://docs.logicaffeine.com/logicaffeine_proof/sym_break/fn.variable_automorphism_group): The variable-permutation automorphism group of a CNF, fully enumerated via the Schreier–Sims backend (for complete symmetry breaking). `None` if a generator flips a phase, or `|G| > cap` (then the caller should use per-generator partial breaking on `variable_automorphism_generators` instead, which scales to arbitrarily large groups). ## logicaffeine_proof::sym_certify Certified symmetry breaking — the centerpiece. Given a formula and a set of verified symmetry generators, add lex-leader symmetry-breaking predicates as PR steps (each self-checked, fail-closed), solve the augmented formula, and emit a single composed refutation that an independent checker accepts against the original formula alone. - [struct CertifiedRefutation](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/struct.CertifiedRefutation): The outcome of a certified-symmetry-breaking solve. - [fn certified_unsat](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.certified_unsat): Solve `formula` with certified symmetry breaking under the given `generators` (each must be a genuine automorphism — they are re-checked implicitly by the per-clause PR self-check). - [fn certified_unsat_auto](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.certified_unsat_auto): Solve `formula` with FULL certified symmetry breaking, discovering the symmetries itself. - [fn certified_unsat_lex](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.certified_unsat_lex) - [fn heule_clique_ranked](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.heule_clique_ranked): The steered clique-coloring refutation with its rank function attached — the analogue of `heule_php_ranked` over the coloring encoding, so a clique refutation also ships a checkable `O(n²)` size certificate (rank = active vertices remaining). - [fn heule_clique_refutation](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.heule_clique_refutation): Full-chain structural steering of `clique_coloring(n, k)` (UNSAT for `k < n`): the Heule pigeonhole refutation transplanted onto the coloring encoding, wielding the a-priori vertex-swap symmetry rather than detecting it. `k + 1` mutually-adjacent vertices already form a PHP(k+1, k), so the proof forces those `k+1` vertices out of the colors one at a time — each clause `¬x(i, color)` certified by the substitution “swap vertex `i` with the last active vertex”, whose SR check clashes at once on the corresponding at-most-one clause. The whole stream is verified against the original clique formula alone. - [fn heule_php_ranked](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.heule_php_ranked): The Heule PHP(n) refutation with its rank function attached — each symmetry-breaking step is tagged by the round (`m` = active items remaining) it belongs to, a non-increasing measure whose descent bounds the proof size. The closing RUP steps take the bottom rank `1`. Feed the result to `crate::complexity::RankedRefutation::certify` to get a checkable `O(n²)` size bound alongside the correctness check. - [fn heule_php_refutation](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.heule_php_refutation): The Heule–Kiesl–Biere short PR refutation of PHP(n): a polynomial-size, fully certified proof — where the lex-leader provably cannot scale on UNSAT instances. - [fn lex_leader_clauses](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.lex_leader_clauses): Build the full lex-leader symmetry-breaking predicate for `sigma` over the moved-variable order, enforcing `x ≤ₗₑₓ σ(x)`. Returns the clauses (over base variables plus fresh auxiliary “tied-so-far” variables `e_i`, allocated starting at `aux_start`) and the number of aux variables used. This is the linear-size encoding that prunes the entire non-leader half of every σ-orbit — the real search-collapse predicate. - [fn symmetry_break_certified](https://docs.logicaffeine.com/logicaffeine_proof/sym_certify/fn.symmetry_break_certified): Solve `formula` with FULL certified lex-leader symmetry breaking. For each generator, add the complete lex-leader chain (enforcing `x ≤ₗₑₓ σ(x)`) as PR steps — each clause certified by a principled witness — then solve and append the learned clauses as RUP steps. This prunes the non-leader half of every σ-orbit (real search collapse), with the whole refutation checked against `formula` alone. A generator whose chain cannot be fully certified is skipped (fail-closed); the result stays sound. Augment `formula` with the certified full lex-leader symmetry-breaking clauses for each generator, committing a generator’s chain only when every clause of it certifies (else the generator is skipped — fail-closed). Returns the augmented clause set, the extended variable count (base + auxiliaries), and the PR proof steps that justify the added clauses. This is the symmetry-breaking front half shared by certified solving and by search-collapse measurement. ## logicaffeine_proof::sym_dynamic Dynamic symmetry breaking — Symmetric Explanation Learning (SEL), the in-search tier. - [enum SelOutcome](https://docs.logicaffeine.com/logicaffeine_proof/sym_dynamic/enum.SelOutcome): The result of an SEL refutation attempt. - [fn sel_refute](https://docs.logicaffeine.com/logicaffeine_proof/sym_dynamic/fn.sel_refute): Refute `clauses` with Symmetric Explanation Learning, or report SAT / Unknown. The conflict budget per round and the round cap bound the work; symmetric amplification is what makes the total conflict count collapse on symmetry-rich instances. ## logicaffeine_proof::symmetry Symmetry breaking for the general solver — the second pillar (with `crate::pigeonhole` cardinality reasoning) for winning on pigeonhole. - [fn break_symmetries](https://docs.logicaffeine.com/logicaffeine_proof/symmetry/fn.break_symmetries): Augment `e` with lex-leader SBPs for every adjacent row-interchange symmetry we can verify. Returns `e` unchanged when the formula is not a readable clause set, has no rows, or no verified symmetry — symmetry breaking is purely additive and never changes the SAT/UNSAT verdict. - [fn lex_le](https://docs.logicaffeine.com/logicaffeine_proof/symmetry/fn.lex_le): “X ≤ₗₑₓ Y” over equal-length boolean vectors (false < true), MSB-first: at the first index where they differ, X has `false` and Y has `true`. Encoded with a chain of “equal-so-far” auxiliaries `{aux}_eq_{k}` (distinct constraints must use distinct `aux`). Returns a tautology for empty/ length-1-or-shorter vectors handled position-by-position. ## logicaffeine_proof::symmetry_detect General symmetry detection for CNF — the engine behind certified symmetry breaking. - [struct AutomorphismIndex](https://docs.logicaffeine.com/logicaffeine_proof/symmetry_detect/struct.AutomorphismIndex): An incrementally-maintained clause database for fast repeated automorphism checks. - [fn aut_order](https://docs.logicaffeine.com/logicaffeine_proof/symmetry_detect/fn.aut_order): `|Aut(F)|` — the exact number of formula automorphisms, via the Schreier–Sims backend. - [fn automorphism_group](https://docs.logicaffeine.com/logicaffeine_proof/symmetry_detect/fn.automorphism_group): The formula’s automorphism group as a BSGS — Schreier–Sims as the symmetry backend. The detected generators (`find_generators`) are bridged to permutations of the `2·num_vars` literal points and a base + strong generating set is built, so the symmetry layer can compute `|Aut(F)|` (`crate::permgroup::Bsgs::order`) and decide membership / cosets (`crate::permgroup::Bsgs::contains`) in polynomial time — group computations it previously could not do (it worked only with the raw generators). The stabilizer chain is the symmetry break, generalized from the abelian linear engines to an arbitrary (non-abelian) permutation group. - [fn find_generators](https://docs.logicaffeine.com/logicaffeine_proof/symmetry_detect/fn.find_generators): Find a generating set of the symmetry group of `clauses` — literal permutations `σ` with `σ(F) = F`. Each returned generator is independently verified by `perm_is_automorphism`. - [fn perm_is_automorphism](https://docs.logicaffeine.com/logicaffeine_proof/symmetry_detect/fn.perm_is_automorphism): Is `sigma` a genuine automorphism of `clauses` — does applying it map the clause set exactly onto itself? The independent re-verification every generator must pass. ## logicaffeine_proof::tactic A tactic framework with a first-class goal state — the interactive proof interface (ROOT R5 of the Lean-competitive architecture). - [mod combinators](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/): Tactic values and the combinators that compose them — the language layer over the primitive `ProofState` methods. The backtracking combinators (`first`, `try_`, `repeat`) speculate on a clone of the state and commit only on success, so a partial failure never corrupts the proof. - [struct CtorSpec](https://docs.logicaffeine.com/logicaffeine_proof/tactic/struct.CtorSpec): One constructor of an inductive, as given to `ProofState::induction_over`: its name and, per positional argument, whether that argument is itself of the inductive type — a recursive position that carries an induction hypothesis. `Nil` is `CtorSpec { constructor: "Nil", recursive: vec![] }`; `Cons` (head then tail) is `CtorSpec { constructor: "Cons", recursive: vec![false, true] }`. - [struct Goal](https://docs.logicaffeine.com/logicaffeine_proof/tactic/struct.Goal): A single proof obligation: prove `target` under the local `hyps`. - [struct Hyp](https://docs.logicaffeine.com/logicaffeine_proof/tactic/struct.Hyp): A local hypothesis: its `name`, its proposition `prop`, and `proof` — a derivation that proves `prop` in the current local context. For a hypothesis that is directly in scope (a premise, an `intro`-discharged antecedent, or a branch hypothesis bound by `cases`) the proof is a `PremiseMatch` leaf the certifier resolves against the bound/registered hypothesis. For a conjunct extracted by `cases` from `A ∧ B`, the proof is the `ConjunctionElim` PROJECTION of the parent — so using the conjunct emits the projection, not a dangling reference. This is what lets elimination compose with the rest. - [struct ProofState](https://docs.logicaffeine.com/logicaffeine_proof/tactic/struct.ProofState): The interactive proof state: the partial derivation plus the queue of open goals (front = focused). Tactics consume the focused goal and push any subgoals they create back to the front, so the proof is built depth-first, first-subgoal first — the order a reader expects. `Clone` is cheap relative to a proof and is what lets the backtracking combinators (`first`/`try`/`repeat`) speculate. - [enum PTerm](https://docs.logicaffeine.com/logicaffeine_proof/tactic/enum.PTerm): A term as a proof SCRIPT writes it — the argument of `exact`, `have`, `refine`, `use`. - [enum TacticError](https://docs.logicaffeine.com/logicaffeine_proof/tactic/enum.TacticError): What went wrong applying a tactic. - [type Tactic](https://docs.logicaffeine.com/logicaffeine_proof/tactic/type.Tactic): A first-class tactic: a transformation of the proof state that either makes progress (`Ok`) or does not apply (`Err`). Tactics are values, so they compose with the `combinators`. ## logicaffeine_proof::tactic::combinators Tactic values and the combinators that compose them — the language layer over the primitive `ProofState` methods. The backtracking combinators (`first`, `try_`, `repeat`) speculate on a clone of the state and commit only on success, so a partial failure never corrupts the proof. - [fn all_goals](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.all_goals) - [fn any_goals](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.any_goals): `t1 <;> t2`-style: apply `t` to EVERY goal currently open (not just the focused one). Each goal is focused in turn; the subgoals `t` produces for it become the new open set, in original goal order. `any_goals t`: run `t` on every open goal, keeping the goals it left and the goals it declined alike, and succeed iff it succeeded on AT LEAST ONE. - [fn apply](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.apply): `apply name` (modus ponens against a named rule) as a tactic value. - [fn assumption](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.assumption): `assumption` as a tactic value. - [fn auto](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.auto): `auto` (the backward chainer) as a tactic value. - [fn by_contra](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.by_contra): `by_contra h` as a tactic value. - [fn by_rule](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.by_rule): `by_rule R` as a tactic value — discharge the goal with the NAMED inference rule. - [fn calc](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.calc): `calc h1 h2 …` as a tactic value — compose the named chain. - [fn cases](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.cases): `cases name` (∧/∨/∃ elimination) as a tactic value. - [fn cases_with](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.cases_with): `cases name with a b` as a tactic value. - [fn crush](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.crush): `crush` as a tactic value. - [fn decide](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.decide): `decide` as a tactic value. - [fn exact](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.exact): `exact name` as a tactic value. - [fn exact_term](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.exact_term): `exact ` as a tactic value. - [fn exists](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.exists): `exists witness` (∃I) as a tactic value. - [fn exists_term](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.exists_term): `exists ` as a tactic value, with the witness resolved against the goal’s scope. - [fn first](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.first): `first [t1, t2, …]`: try each tactic on a speculative copy and commit the first that succeeds; fail only if none apply. - [fn focus](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.focus): `· t` / `focus t` / `next t`: run `t` on the focused goal ALONE, and make it an error for the block to leave that goal open. - [fn have](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.have): `have name from ` as a tactic value. - [fn induction](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.induction): `induction` (structural induction over `Nat`) as a tactic value. - [fn induction_on](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.induction_on): `induction name` as a tactic value. - [fn induction_over](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.induction_over): `induction_over` (generic structural induction over `ind_type`) as a tactic value. - [fn intro](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.intro): `intro name` as a tactic value. - [fn left](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.left): `left` (∨I) as a tactic value. - [fn linarith](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.linarith): `omega` as a tactic value. `linarith` (rational Fourier-Motzkin with a Farkas certificate) as a tactic value. - [fn omega](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.omega) - [fn refine](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.refine): `refine ` as a tactic value. - [fn repeat](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.repeat): `repeat t`: apply `t` as long as it keeps applying (committing each success), then stop. Always succeeds. Bounded to avoid a non-progressing tactic looping forever. - [fn rewrite](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.rewrite) - [fn rewrite_at](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.rewrite_at): `rewrite name` (Leibniz substitution by an equality) as a tactic value. `rewrite h at k` as a tactic value — the `k`-th occurrence, 0-based. - [fn rewrite_hyp_at](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.rewrite_hyp_at): `rewrite h at hp` — the LOCATION form, rewriting a HYPOTHESIS rather than the goal. - [fn rfl](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.rfl): `rfl` (close `t = t` by reflexivity) as a tactic value. - [fn right](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.right): `right` (∨I) as a tactic value. - [fn ring](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.ring): `ring` (commutative-ring normalisation) as a tactic value. - [fn seq](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.seq): `t1; t2; …`: run each tactic in turn; fail (without committing the rest) at the first that does not apply. - [fn simp](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.simp): `simp` as a tactic value, its rule set drawn from everything in scope (premises, intro’d hypotheses, cited lemmas) — the script-level default. - [fn simp_only](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.simp_only): `simp only [a, b]` as a tactic value — the rule set is exactly the named hypotheses. - [fn simp_with](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.simp_with): `simp [a, b]` as a tactic value — Lean’s “these AS WELL”, which for a default set that is already the whole scope adds nothing. The names are still resolved, so a typo is an error rather than a silently ignored rule. - [fn split](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.split): `split` (∧I) as a tactic value. - [fn then_all](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.then_all): `t1 <;> t2`: run `t1` on the focused goal, then `t2` on exactly the goals `t1` PRODUCED — not on every goal that happens to be open. - [fn try_](https://docs.logicaffeine.com/logicaffeine_proof/tactic/combinators/fn.try_): `try t`: run `t` if it applies, otherwise leave the state unchanged. Always succeeds. ## logicaffeine_proof::tactic_cert Certificate producers and independent checkers shared with the kernel rechecker. - [struct CcCert](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/struct.CcCert): A checkable proof that a goal’s conclusion follows from its hypotheses by congruence. - [struct LiaCert](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/struct.LiaCert): A refutation of a constraint system, as the multipliers that refute it. - [enum CcStep](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/enum.CcStep): One step of an equality proof. - [enum CertifiablePrimitive](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/enum.CertifiablePrimitive): A tactic reduction primitive a second kernel can now corroborate. - [enum Syn](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/enum.Syn): The object language’s four shapes, as this module reads them. - [fn check_cc](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.check_cc): Check a congruence proof against a goal. - [fn check_lia](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.check_lia): Check a Farkas certificate against a `try_lia` goal. - [fn emit_cc](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.emit_cc): Search for a congruence proof of `goal` — UNTRUSTED. - [fn emit_lia](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.emit_lia): Emit a Farkas certificate for a `try_lia` goal, or `None` when the search finds none. - [fn syn_apply](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.syn_apply): `SApp f x`. - [fn syn_binary](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.syn_binary): `SApp (SApp (SName op) a) b`. - [fn syn_of_term](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.syn_of_term): Read a kernel `Term` as reflected object syntax, or `None` if it is not one. - [fn syn_typed_eq](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.syn_typed_eq): `SApp (SApp (SApp (SName "Eq") (SName ty)) a) b` — the typed equation `try_ring` reads. - [fn term_of_syn](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.term_of_syn): The same reflected syntax as a kernel `Term`, so a caller can hand the FIRST kernel exactly the goal it handed this module — which is what makes a differential between the two a differential and not two different questions. - [fn verify_cc](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.verify_cc): `try_cc goal` reduces to `DccSolve goal`, verified from a certificate this module both produced and then checked without reference to how it was produced. - [fn verify_lia](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.verify_lia): `try_lia goal` reduces to `DLiaSolve goal`, verified from a certificate this module both produced and then checked without reference to how it was produced. - [fn verify_ring](https://docs.logicaffeine.com/logicaffeine_proof/tactic_cert/fn.verify_ring): `try_ring goal` reduces to `DRingSolve goal`, verified here. ## logicaffeine_proof::tactic_script A tiny proof-script language over the `crate::tactic` combinators — proofs as TEXT, the way a Lean/Coq proof reads. This is the self-contained seam toward a full English vernacular: it has no dependency on the surface language, so it compiles a script string straight into a composed `Tactic`. - [struct ScriptError](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/struct.ScriptError): A script parse error, with a human-readable reason. - [struct ScriptedTheorem](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/struct.ScriptedTheorem): One theorem of a scripted library: proved from its own `premises` plus the conclusions of the theorems it `cites`, by running `script` to a kernel-checked proof. The unit the `prove_scripted_library` driver discharges in citation order. - [struct TacticEnv](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/struct.TacticEnv): A registry of USER-DEFINED tactics (M) — the metaprogramming seam. A user names a composite tactic (built from primitives and combinators) with `TacticEnv::define`, and may then reference it BY NAME in any later script, including from within other user-defined tactics. This is “write your own tactic in the language”, without Rust — the definitions are stored as source and re-expanded (depth-bounded, so a recursive definition is rejected rather than looping) wherever the name appears. - [fn canonical](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/fn.canonical): Map an English-esque verb to its canonical tactic name. `Suppose`/`assume`/`let` all mean `intro`; `automatically`/`trivially` mean `auto`; and so on — the vocabulary that lets a proof read like prose. Case-insensitive. Public so an editor highlights exactly the words the engine accepts. - [fn parse_script](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/fn.parse_script): Compile a proof-script string into a composed `Tactic` (no user-defined tactics). - [fn parse_script_with_env](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/fn.parse_script_with_env): Compile a proof-script string with USER-DEFINED tactics resolved from `env` (M). - [fn prove_scripted_library](https://docs.logicaffeine.com/logicaffeine_proof/tactic_script/fn.prove_scripted_library): Discharge a library of scripted theorems in citation order, on a shared `axioms` base. Each theorem is proved by its `ScriptedTheorem::script` from its premises, the axioms, and the conclusions of the theorems it cites (already proved); a proved conclusion becomes a citable lemma for later theorems — the scraped-Euclid-graph discipline, now driven by tactic scripts. Results come back in INPUT order. ## logicaffeine_proof::thermal_replay Thermal-map replay — the independent judge of a claimed steady-state temperature map. - [struct ThermalClaim](https://docs.logicaffeine.com/logicaffeine_proof/thermal_replay/struct.ThermalClaim): The neutral thermal claim a stack’s thermal solve emits. - [struct ThermalVerdict](https://docs.logicaffeine.com/logicaffeine_proof/thermal_replay/struct.ThermalVerdict): What a TRUE map says. The junction-limit judgment belongs to the cooling phase’s consumer — the verdict reports the physics, it does not editorialize. - [fn check_thermal_claim](https://docs.logicaffeine.com/logicaffeine_proof/thermal_replay/fn.check_thermal_claim): THE judge. `Some(verdict)` iff the claim is well-formed, physically coherent, and the reassembled `G·ΔT` equals `P` EXACTLY at every node. ## logicaffeine_proof::trace_determinism The concurrency tie made literal: determinism = contractibility, on a real machine. - [struct Op](https://docs.logicaffeine.com/logicaffeine_proof/trace_determinism/struct.Op): A shared-memory operation: read some cells, then write one cell with a pure function of the reads (in `reads` order). The minimal unit that can race. - [fn bernstein_independent](https://docs.logicaffeine.com/logicaffeine_proof/trace_determinism/fn.bernstein_independent): Bernstein’s conditions — `a` and `b` commute (are independent) iff neither writes a cell the other reads or writes. This is the independence relation of the trace monoid: precisely the pairs whose commutation square is a 2-cell in `ProofPoset`. (Read–read sharing is fine; reads commute.) - [fn run](https://docs.logicaffeine.com/logicaffeine_proof/trace_determinism/fn.run): Run a schedule (a sequence of op indices) from an initial state, returning the final state. - [fn trace_poset](https://docs.logicaffeine.com/logicaffeine_proof/trace_determinism/fn.trace_poset): The commutation poset of a set of concurrent operations: independent pairs (Bernstein) are left unordered — their commutation is a 2-cell — and conflicting pairs get a program-order edge (lower index first), which is the only way to keep a deterministic execution. The trace’s cube complex. ## logicaffeine_proof::two_group The 2-group frontier — climbing past `K(G,1)` to genuine 2-types, honestly. - [struct CrossedModule](https://docs.logicaffeine.com/logicaffeine_proof/two_group/struct.CrossedModule): A crossed module `∂: H → G` — the algebraic model of a 2-group. `partial[h]` is `∂(h) ∈ G`, a group homomorphism. Its homotopy groups are `π₁ = coker(∂)` and `π₂ = ker(∂)`. - [struct FiniteGroup](https://docs.logicaffeine.com/logicaffeine_proof/two_group/struct.FiniteGroup): A finite group by its (0-indexed) multiplication table. ## logicaffeine_proof::two_type A genuinely 2-truncated ∞-groupoid, had as an object: the minimal `K(A, 2)`. ## logicaffeine_proof::twosat 2-SAT in linear time via the implication graph + strongly-connected components. - [struct Lit](https://docs.logicaffeine.com/logicaffeine_proof/twosat/struct.Lit): A literal: variable `var`, positive when `pos`. - [enum TwoSatOutcome](https://docs.logicaffeine.com/logicaffeine_proof/twosat/enum.TwoSatOutcome): The outcome of solving a 2-SAT instance. - [fn is_refutation](https://docs.logicaffeine.com/logicaffeine_proof/twosat/fn.is_refutation): Re-check an `Unsat` witness: in the implication graph, `x` reaches `¬x` and `¬x` reaches `x` (mutual implication ⇒ no value of `x` is consistent). A solver-free certificate. - [fn satisfies](https://docs.logicaffeine.com/logicaffeine_proof/twosat/fn.satisfies): Re-check a satisfying assignment: every clause has a true literal. - [fn solve](https://docs.logicaffeine.com/logicaffeine_proof/twosat/fn.solve): Decide a 2-SAT instance (`clauses` of two literals each — a unit clause is `(a, a)`). Returns a satisfying assignment, or the variable whose SCC contains both polarities. ## logicaffeine_proof::unify First-order unification for proof search. - [fn apply_subst_to_expr](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.apply_subst_to_expr): Apply a substitution to an expression. - [fn apply_subst_to_term](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.apply_subst_to_term): Apply a substitution to a term. - [fn beta_reduce](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.beta_reduce): Beta-reduce an expression to Weak Head Normal Form (WHNF). - [fn compose_substitutions](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.compose_substitutions): Compose two substitutions: apply s2 after s1. - [fn instantiate_expr](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.instantiate_expr): Instantiate one binder: `body[var := t]`, the formula a quantifier’s body states of `t`. - [fn match_expr_pattern](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.match_expr_pattern): One-sided match of an expression `pattern` against a `target` (see `match_term_pattern`). Quantified subexpressions match name-strictly (no alpha-renaming — conservative: an alpha-variant simply fails), and a pattern variable never binds a term that mentions a bound variable (capture is rejected, not silently permitted). - [fn match_term_pattern](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.match_term_pattern): One-sided match of a term `pattern` against a `target`: pattern `Variable`s bind target subterms; the target is inspected, never bound. Repeated pattern variables must bind the same subterm. This is the arbiter behind discrimination-tree retrieval (`crate::discrimination`) — the tree over-approximates, this decides. - [fn unify_exprs](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.unify_exprs): Unify two expressions, returning the Most General Unifier. - [fn unify_pattern](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.unify_pattern): Attempt higher-order pattern unification (Miller patterns). - [fn unify_terms](https://docs.logicaffeine.com/logicaffeine_proof/unify/fn.unify_terms): Unify two terms, returning the Most General Unifier (MGU). - [type ExprSubstitution](https://docs.logicaffeine.com/logicaffeine_proof/unify/type.ExprSubstitution): Substitution for expression-level meta-variables (holes). - [type Substitution](https://docs.logicaffeine.com/logicaffeine_proof/unify/type.Substitution): A substitution mapping variable names to terms. ## logicaffeine_proof::units Equivalence over units proven apart: two circuits built of units (adders, multipliers, any module already proven equal to its counterpart), each unit cut out of its circuit — its results free inputs, its operands outputs — and the two decided over the units as functions they know nothing of, a unit’s own proof standing for what it computes. - [struct Application](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Application): A unit of a side applied at a clock: the side (0 left, 1 right), the unit’s index, the clock of its operands. - [struct Claim](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Claim): An output bit a side claims at a clock, under the name its counterpart on the other side is claimed by. - [struct Report](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Report): A decision over units: a verdict per output name, the rounds that made it, and the last round’s cost. - [struct Round](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Round): A round: the identifications its derivation justifies (an application kept, and one whose results become the kept one’s), and the derivation, from the round’s miter, of their operands’ equalities — in the last round, of the outputs’ equalities. - [struct Side](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Side): One side: its cut circuit, the clock its own outputs are read at, and its units. - [struct Unit](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Unit): A unit of a cut circuit: its instance name, the function it computes (its module), the clocks its results follow its operands by, and the names of its operand bits (outputs of the cut circuit) and result bits (inputs of it). - [struct Unrolled](https://docs.logicaffeine.com/logicaffeine_proof/units/struct.Unrolled): A side unrolled `frames` clocks: what each named input is at each clock (`bind`), the output bits it claims, and its units. An input with no name is a fresh one of the side’s own at every clock, whatever `bind` says. - [enum Binding](https://docs.logicaffeine.com/logicaffeine_proof/units/enum.Binding): What a side’s named input is at a clock: one input both sides share by its name, a constant the environment holds it at, or a fresh input of the side’s own. - [fn decide](https://docs.logicaffeine.com/logicaffeine_proof/units/fn.decide): Decide `left` against `right` over their units, the functions of `functions` (each a left function, the right one proven equal to it) the only ones identified. - [fn decide_unrolled](https://docs.logicaffeine.com/logicaffeine_proof/units/fn.decide_unrolled): `decide` over sides unrolled as each says: the claims of one name, one on each side, are an output pair. ## logicaffeine_proof::verify Unified theorem verification — the single door. - [struct AxiomFootprint](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.AxiomFootprint): What a certified proof term actually RESTS ON — the `#print axioms` analogue. - [struct ConflictReport](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.ConflictReport): The result of checking a rule set for an internal contradiction. - [struct Definition](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.Definition): A user-introduced predicate definition (Rung 0a), expressed in the proof layer’s own vocabulary so `logicaffeine_proof` keeps its no-language-dependency invariant. Read as `name(params) :↔ definiens`. - [struct DependencyGraph](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.DependencyGraph): The `uses` dependency graph among definitions and from a theorem to its definitions — the Rung 0b graph seed (each node a definition/theorem, each edge a `uses`). Direct edges only; transitive use is a query over this. This is the structure a `mathscrapes` node/edge compiles into. - [struct LibraryResult](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.LibraryResult): The outcome of proving one theorem in a library. - [struct LibraryTheorem](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.LibraryTheorem): One theorem in a dependency-ordered library: proved from its own `premises` plus the conclusions of the theorems it `cites`. This is the unit the multi-theorem driver discharges in citation order (the Euclid-graph engine). - [struct ScopedChecker](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.ScopedChecker): A kernel context prepared ONCE from a scope, against which many candidate derivations can then be checked — the reusable half of `check_derivation`. - [struct VerifiedProof](https://docs.logicaffeine.com/logicaffeine_proof/verify/struct.VerifiedProof): Outcome of running a goal through prove → certify → kernel type-check. - [fn check_derivation](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.check_derivation): Certify and kernel-check a derivation built EXTERNALLY (e.g. by the fast grid solver) against `premises ⊢ goal`, WITHOUT running the backward chainer. The trust guarantee is identical to `prove_certify_check`: `verified` is true only when the certifier produced a kernel term whose inferred type IS the goal type. So an external solver sits OUTSIDE the trusted base — it hands us a `DerivationTree`, the kernel re-checks it, and a wrong tree yields `verified == false`, never a false claim. - [fn check_derivation_with_defs](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.check_derivation_with_defs): Like `check_derivation` but with user `Definition`s in scope (Rung 0a), so an externally-built derivation of a definiens can certify against a goal stated with the definiendum — δ reconciles them at the root. - [fn close_over_context_locals](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.close_over_context_locals): The UNIVERSAL CLOSURE of a proof term: `term` wrapped in a λ for every LOCAL binding of `ctx` that occurs free in it, so the result is closed. - [fn dependency_graph](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.dependency_graph): Build the `DependencyGraph` for a set of definitions plus a theorem (premises + goal), recording which definitions each definiens uses and which the theorem uses. Pure, allocation-light, O(total expression size). - [fn detect_conflict](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.detect_conflict): Detect whether `premises` are jointly inconsistent, returning a kernel-checked proof of `False` and the indices of the clashing premises. - [fn prove_certify_check](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.prove_certify_check): Prove `goal` from `premises`, certify the derivation, and kernel-check it. - [fn prove_certify_check_bounded](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.prove_certify_check_bounded): Like `prove_certify_check` but caps the backward-chainer search depth, so a goal the kernel cannot reach fails FAST instead of exhausting the default depth. Keeps “prove-with-ours-first” cheap when answering a grid cell by cell: a shallow kernel attempt certifies what it can, then falls through to the oracle. - [fn prove_certify_check_bounded_with_defs](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.prove_certify_check_bounded_with_defs): The depth-bounded pipeline with user definitions (Rung 0a). Definitions are validated (recursion + lowering) up front, registered as δ-unfoldable kernel definitions in the context, then the goal is proved and kernel-checked. The engine still treats the definiendum opaquely during search (Stride 3 adds expand-for-search); δ reconciles the certified term with the folded goal type at the `finish_check` root. - [fn prove_certify_check_with_defs](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.prove_certify_check_with_defs): Like `prove_certify_check` but with user `Definition`s in scope (Rung 0a). - [fn prove_library](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.prove_library): Discharge a library of theorems in citation order. Each theorem is proved from its own premises plus the conclusions of the (already-proved) theorems it cites, so a citation graph is walked exactly like the scraped Euclid dependency graph. Results are returned in the INPUT order. A citation of an unproved/failed theorem simply isn’t available as a premise (so the dependent proof fails too). - [fn prove_library_with_axioms](https://docs.logicaffeine.com/logicaffeine_proof/verify/fn.prove_library_with_axioms): Like `prove_library` but with a shared `axioms` base in scope for every theorem — a named theory (e.g. the Tarski geometry axioms) on which the whole dependency graph is discharged. ## logicaffeine_proof::xl XL — algebraic cryptanalysis of multivariate quadratic (MQ) systems by linearization. - [struct Gf2](https://docs.logicaffeine.com/logicaffeine_proof/xl/struct.Gf2): GF(2) as the multilinear ring: elements `0`/`1`, addition is XOR, multiplication is AND. - [struct Gf256](https://docs.logicaffeine.com/logicaffeine_proof/xl/struct.Gf256): GF(2^8) — the field of the multivariate-signature attack surface. All arithmetic delegates to `logicaffeine_base::gf256` (the exhaustively-verified shared field substrate). - [struct MQSystem](https://docs.logicaffeine.com/logicaffeine_proof/xl/struct.MQSystem): A multivariate quadratic system in `n` variables: solutions are the common zeros of `polys`. - [trait Field](https://docs.logicaffeine.com/logicaffeine_proof/xl/trait.Field): A finite field small enough to enumerate — the arithmetic XL runs its linear algebra over. - [fn eval](https://docs.logicaffeine.com/logicaffeine_proof/xl/fn.eval): Evaluate a polynomial at an assignment `x` (length ≥ every variable index used). - [fn xl_solve](https://docs.logicaffeine.com/logicaffeine_proof/xl/fn.xl_solve): Solve an MQ system by XL: linearize at increasing degrees `d` up to `max_degree`, and at each degree read the linear variables off the linear solution and verify them against the original system. Returns a verified common zero, or `None` if none was found by `max_degree`. - [type Poly](https://docs.logicaffeine.com/logicaffeine_proof/xl/type.Poly): A polynomial: monomial → coefficient, only non-zero terms stored. ## logicaffeine_proof::xor_drat The CNF→GF(2) bridge: compile a Gaussian (XOR linear-dependency) refutation into a strict DRAT proof that an external checker (`drat-trim`) accepts. - [fn emit_drat_over_support](https://docs.logicaffeine.com/logicaffeine_proof/xor_drat/fn.emit_drat_over_support): Resolution-refute the sub-CNF confined to the `support` variables — the convention-agnostic bridge. The emitted clauses are resolvents of real CNF clauses, so each is RUP against the original formula by construction and a `drat-trim` check holds. `None` if that sub-CNF is not UNSAT (so the caller’s algebraic verdict could not be reproduced clausally — a fail-closed signal). - [fn emit_modp_drat](https://docs.logicaffeine.com/logicaffeine_proof/xor_drat/fn.emit_modp_drat): The CNF→GF(p) bridge: compile a modular (mod-p / counting) UNSAT verdict into a strict DRAT proof. We recover the one-hot modular system from `clauses`, solve it over the prime field, and — on UNSAT — resolution-refute the sub-CNF confined to the one-hot bits of the involved groups. That sub-CNF (the forbidden-tuple gadgets of the combination’s equations together with their groups’ at-least-one/at-most-one clauses) is unsatisfiable, so DP elimination over those Boolean variables yields the empty clause, every line RUP against the original CNF. `None` if the formula is not a recoverable mod-p encoding or its modular system is satisfiable. - [fn emit_xor_drat](https://docs.logicaffeine.com/logicaffeine_proof/xor_drat/fn.emit_xor_drat): Compile the GF(2) linear-dependency refutation `refutation` (equation indices whose XOR is `0=1`, from `crate::xorsat::solve`) into a DRAT proof: the ordered resolvent clauses, ending in the empty clause. Pair these with the original CNF for `crate::rup::check_refutation` or `drat-trim`. - [fn gadget_clauses](https://docs.logicaffeine.com/logicaffeine_proof/xor_drat/fn.gadget_clauses): The full parity gadget of `eq`: one clause per wrong-parity assignment of its variables. These are exactly the CNF clauses a Tseitin/XOR encoding carries for the constraint. ## logicaffeine_proof::xor_engine DPLL(XOR) — the live GF(2) reasoning engine. - [struct IncXor](https://docs.logicaffeine.com/logicaffeine_proof/xor_engine/struct.IncXor): Incremental GF(2) engine — the fast DPLL(XOR) core. - [struct XorEngine](https://docs.logicaffeine.com/logicaffeine_proof/xor_engine/struct.XorEngine): A GF(2) constraint system with Gaussian reasoning under a partial assignment. - [enum XorStep](https://docs.logicaffeine.com/logicaffeine_proof/xor_engine/enum.XorStep): The result of consulting the engine at a Boolean fixpoint. ## logicaffeine_proof::xorsat XOR-SAT via Gaussian elimination over GF(2) — the parity analog of the pigeonhole/matching supercrush. - [struct XorEquation](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/struct.XorEquation): A parity equation: the XOR of the variables in `vars` equals `rhs`. (Repeated variables cancel, per GF(2).) - [enum XorOutcome](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/enum.XorOutcome): The outcome of solving an XOR system. - [fn is_refutation](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/fn.is_refutation): Re-check a refutation: the XOR of the chosen equations is `0 = 1` — their variables all cancel while their right-hand sides sum to 1. A solver-free certificate of unsatisfiability. - [fn refute_via_parity](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/fn.refute_via_parity): Recognize the XOR (parity) gadgets inside a CNF `ProofExpr` and refute via Gaussian elimination — the GF(2) shadow, as a fast-path for `crate::sat::prove_unsat`. A parity constraint `x_{a} ⊕ … ⊕ x_{z} = r` over `k` variables is encoded in CNF as exactly the `2^{k-1}` clauses that forbid the wrong-parity assignments; we group clauses by their variable set, and whenever a group is precisely such a full wrong-parity bundle we recover its `XorEquation`. - [fn satisfies](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/fn.satisfies): Re-check a satisfying assignment: every equation’s variable-XOR equals its rhs. - [fn solve](https://docs.logicaffeine.com/logicaffeine_proof/xorsat/fn.solve): Solve a parity system over `0..num_vars` by Gauss–Jordan elimination over GF(2). Returns a satisfying assignment or a certified `0 = 1` refutation. `O(eq · vars · (eq+vars)/64)`.