Skip to content

The quantifier census: 100 walkable domains out of 1005 - #2793

Merged
gHashTag merged 2 commits into
masterfrom
w703-quantifier-census
Aug 29, 2026
Merged

The quantifier census: 100 walkable domains out of 1005#2793
gHashTag merged 2 commits into
masterfrom
w703-quantifier-census

Conversation

@gHashTag

Copy link
Copy Markdown
Owner

feat(tri): the quantifier census -- 100 walkable domains out of 1005

tri quantifiers report. Reading only: no parse changes, no lowering, no
generated artefact, no discard count moves.

WHY THIS AND NOT A LOWERING. Three independently written proposals for #2774 --
one arguing to capture and never lower, one to enumerate finite domains, one to
split the four backends apart -- were judged through two adversarial lenses each
and all three survived. They disagree about the lowering and they agree exactly
about the FIRST STEP: report before you lower, because the ceiling cannot be
chosen without the distribution of domain sizes, and nobody had measured it.

quantified clauses found      1005
  colon                        12       invariant name: forall c : Cfg, ...
  prefix                      858       forall input : InferenceInput
  suffix-all                  120       assert p(a) == p(b) for all Trit
  suffix-any                   15       ... for any a, b in {1, -1}

DOMAIN, from declared types only, ceiling 65536
  walkable                     100
  finite but over the ceiling  222
  unbounded                    544
  no binder this can read      139

largest walkable domain        65536  (specs/igla/race/ternary_mac.t27:941)

ALL 135 SUFFIX FORMS HAVE NO READABLE BINDER. for all Trit names a type with
three values and no variable to range over it; for any a, b in {1, -1} names a
set the language has no syntax for. The small domains are exactly the ones
written without a binder, which is the opposite of convenient.

WHAT |D| MEANS, and what it deliberately does not:

  • computed from DECLARED TYPES ALONE. A binder over Trit is 3 whatever the
    body says about it.
  • BOTTOM (printed unbounded) is absorbing, and AN UNRESOLVED NAME IS NOT
    ASSUMED SMALL -- string, []T with no pinned length, and a type this
    cannot resolve are all unbounded.
  • 15 struct names have MORE THAN ONE definition in the corpus and are treated
    as unbounded. Picking one would change |D| by an unbounded factor with
    nothing recording which was picked.
  • NO GUARD IS READ. x.len() == 4 narrows nothing here. That is the part that
    needs a semantics, and this report must not be the thing that quietly
    decides one.

Six tests, four of them for what it must NOT conclude: an unknown type is
unbounded rather than 1, an unpinned array length is unbounded rather than its
element size, a struct defined twice is unbounded even though its fields
resolve, and a prose suffix yields no binder rather than a wrong one.

Refs #2774

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

`tri quantifiers report`. Reading only: no parse changes, no lowering, no
generated artefact, no discard count moves.

WHY THIS AND NOT A LOWERING. Three independently written proposals for #2774 --
one arguing to capture and never lower, one to enumerate finite domains, one to
split the four backends apart -- were judged through two adversarial lenses each
and all three survived. They disagree about the lowering and they agree exactly
about the FIRST STEP: report before you lower, because the ceiling cannot be
chosen without the distribution of domain sizes, and nobody had measured it.

    quantified clauses found      1005
      colon                        12       invariant name: forall c : Cfg, ...
      prefix                      858       forall input : InferenceInput
      suffix-all                  120       assert p(a) == p(b) for all Trit
      suffix-any                   15       ... for any a, b in {1, -1}

    DOMAIN, from declared types only, ceiling 65536
      walkable                     100
      finite but over the ceiling  222
      unbounded                    544
      no binder this can read      139

    largest walkable domain        65536  (specs/igla/race/ternary_mac.t27:941)

ALL 135 SUFFIX FORMS HAVE NO READABLE BINDER. `for all Trit` names a type with
three values and no variable to range over it; `for any a, b in {1, -1}` names a
set the language has no syntax for. The small domains are exactly the ones
written without a binder, which is the opposite of convenient.

WHAT `|D|` MEANS, and what it deliberately does not:

  * computed from DECLARED TYPES ALONE. A binder over `Trit` is 3 whatever the
    body says about it.
  * `BOTTOM` (printed `unbounded`) is absorbing, and AN UNRESOLVED NAME IS NOT
    ASSUMED SMALL -- `string`, `[]T` with no pinned length, and a type this
    cannot resolve are all unbounded.
  * 15 struct names have MORE THAN ONE definition in the corpus and are treated
    as unbounded. Picking one would change `|D|` by an unbounded factor with
    nothing recording which was picked.
  * NO GUARD IS READ. `x.len() == 4` narrows nothing here. That is the part that
    needs a semantics, and this report must not be the thing that quietly
    decides one.

Six tests, four of them for what it must NOT conclude: an unknown type is
unbounded rather than 1, an unpinned array length is unbounded rather than its
element size, a struct defined twice is unbounded even though its fields
resolve, and a prose suffix yields no binder rather than a wrong one.

Refs #2774

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-29 09:44:55 UTC

Summary

Status Count
Total Open PRs 9
PRs with Failing Checks 8
PRs with All Checks Green 1
READY 0
FAILING 8
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=d25ac0cc159e != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

…in (186-188)

Three incompatible designs agreed on one first step, which is the step that
cannot be wrong. I validated a spec fix against a line that was itself failing.
And the default for an unresolvable type must be the answer that makes the tool
refuse.

Refs #2754, #2774

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-08-29 09:46:08 UTC

Summary

Status Count
Total Open PRs 9
PRs with Failing Checks 7
PRs with All Checks Green 2
READY 0
FAILING 7
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=d25ac0cc159e != manifest seal=87e5cbd3ad94.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

@github-actions

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@gHashTag
gHashTag merged commit 6631cbf into master Aug 29, 2026
33 checks passed
@gHashTag
gHashTag deleted the w703-quantifier-census branch August 29, 2026 09:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant