The ~ constants of a root take models that hold together, so a ~ law of a ~ function reaches the kernel (#1182)

[MuhDur]

Closes #1182.

--verdict checks a template at opaque constants k~p, and the kernel needs each one to have a model. The models were picked one at a time: le got λx y. False{}, so a law ~step: … -> {le(x, y) == True{}} had none, the def went out of scope (bend f.bend -o f.bendtt says no model for step_le~step), and --verdict reported a mismatch without running the kernel. A law over a template type, {x == y : A} at A = Unit, had none either.

model_at now yields its models best first, inside #1218's bounded search; the first is the one it returned before, after the same work, so every model model() picks is unchanged (#1338's Unit and datatype checks included). When a constant has none, refit backtracks over the root's constants so far, up to 8 models each, in model_by's rounds of doubling depth on one MODEL_FUEL, so the backtracking is bounded too; def_emit emits the models it chose. Only in that search, a live λ of a datatype whose constructors have no fields, with no model under a variable, gets a match. The kernel still checks every model and the constants stay opaque in the body. Contradictory laws have no models that hold together, so they stay out of scope instead of handing the kernel a closed def of type Empty.

Checks:

• New tests: tests/proof/template_law_models gives SOME PROOFS FAIL under --verdict on main and ALL PROOFS CHECK here; tests/proof/template_laws_contradict is accepted by bend2 and stays out of scope (no model for bad~ir).
• Kernel alone, with the emitted roots' bodies edited to {==}: rejected (expected: le x0 x1, observed: True; expected: x0, observed: x1), so the convenient models don't leak into the proofs.
• On all 1588 tests/**/*.bend, --verdict output and the -o BendTT text are byte-identical to main; only the two new tests are added.
• tsc gives the same 12 errors as main. gates/repo.ts passes 50 / 50; safe.ts goes from 21,935 to 22,836 ttok (cap 24,000).
• On the hub package bend-mathlib, algebra and order (transitivity/associativity chains over a ~le / ~op with their laws as ~ proofs) now pass --verdict; bool, equal, list, maybe, nat, perm and string emit identical BendTT. sort brings its ~le_total roots into scope but still fails on defs out of scope for another reason (a kind that depends on a run-time value).
• Not run: the cluster gates, gates/safe.ts and gates/test.ts included.

Not covered: a ~ law whose only model is a real proof (the injectivity ~F in the original report) still has none.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LLZJANUtM1mTd4jg5kXqJf

[MuhDur]

Rebased onto main after #1218: the candidate models and the backtracking now run inside its bounded search (one MODEL_FUEL, its doubling depth), and model()'s answers stay exactly main's. On all 1554 tests, --verdict and the -o BendTT text are byte-identical to main.

[MuhDur]

Rebased onto main 53fc961 (after #1338/#1220/#1224). #1338's Unit-provenance check is kept inside the unchanged first answer; it does not cover the {x == y : A} at A = Unit case, so the match model stays (only inside refit). On all 1588 tests, --verdict and the -o BendTT text are byte-identical to main apart from the two new tests.