diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 90baa18e..5b8331ff 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,12 @@ on:
benches:
description: space separated bench targets (empty = default set)
default: ""
+ alg_fuzz_cases:
+ description: random cases per algebraic fuzz sweep (release and debug-assert)
+ default: "1000000"
+ alg_fuzz_seed:
+ description: seed for the algebraic fuzz sweeps
+ default: "1"
permissions:
contents: read
@@ -61,9 +67,9 @@ jobs:
bench:
name: bench A/B vs base
- # Runs last, after the tests and the fuzz gate pass (skipped when either fails), on PRs
+ # Runs last, after the tests and both fuzz gates pass (skipped when any fails), on PRs
# and manual runs only; a push to master has nothing to compare against.
- needs: [test, fuzz]
+ needs: [test, fuzz, alg-fuzz]
if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
runs-on: [self-hosted, linux, x64]
timeout-minutes: 300
@@ -251,3 +257,110 @@ jobs:
${{ runner.temp }}/fuzz-out/fails-*
${{ runner.temp }}/fuzz-out/repro
if-no-files-found: ignore
+
+ alg-fuzz:
+ name: algebraic equivalence fuzz
+ # No oracle: every route pathmap offers through its algebra (whole-map ops, write-zipper
+ # forms, experimental::zipper_algebra, OverlayZipper, SubtractZipper, ...) must give the
+ # same trie, and a set of lattice laws must hold. See differential/ALGEBRAIC_FUZZING.md.
+ # Fails on any finding whose signature is missing from differential::algebraic::KNOWN,
+ # which lists what already reproduces on master. The seed and the job count are fixed, so
+ # a red run reproduces locally with the command printed in the job summary: each job draws
+ # its own input stream, so --jobs decides which inputs run, not only how fast. 64 is the
+ # cap; a smaller machine runs the same inputs, oversubscribed.
+ needs: test
+ if: ${{ !cancelled() }}
+ runs-on: [self-hosted, linux, x64]
+ timeout-minutes: 60
+ steps:
+ - uses: actions/checkout@v5
+ - name: toolchain
+ # rustup is installed per runner user on first use
+ run: |
+ [ -x "$HOME/.cargo/bin/rustup" ] || curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain none --no-modify-path
+ echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+ echo "CARGO_TARGET_DIR=$HOME/cache/target" >> "$GITHUB_ENV" # persists outside _work, so builds stay incremental
+ export PATH="$HOME/.cargo/bin:$PATH"
+ rustup toolchain install stable --profile minimal
+ rustup default stable
+ rustc --version && cargo --version
+ - name: harness gate
+ # recogniser invariants, a short sweep, and route coverage; no corpus in CI
+ run: cargo test --release -p differential --test algebraic
+ - name: sweep (release)
+ if: ${{ !cancelled() }}
+ env:
+ CASES: ${{ inputs.alg_fuzz_cases || '1000000' }}
+ SEED: ${{ inputs.alg_fuzz_seed || '1' }}
+ JOBS: 64
+ OUT: ${{ runner.temp }}/alg-fuzz-out
+ run: |
+ cargo build --release -p differential --bin alg_fuzz
+ mkdir -p "$OUT/release"
+ # a hang is a finding too: the survival-search bug in SubtractZipper looped forever
+ rc=0
+ timeout 20m "$CARGO_TARGET_DIR/release/alg_fuzz" --random "$CASES" --seed "$SEED" --jobs "$JOBS" \
+ --out "$OUT/release" > "$OUT/release.txt" 2>&1 || rc=$?
+ [ $rc -eq 124 ] && echo "::error::release sweep timed out (hang?)"
+ tail -n 40 "$OUT/release.txt"
+ exit $rc
+ - name: sweep (debug assertions)
+ # debug_assert!s inside the merge primitives catch defects no route comparison sees.
+ # RUSTFLAGS replaces .cargo/config.toml's flags, so target-cpu=native (needed by gxhash)
+ # is repeated; a separate target dir keeps the release build intact.
+ if: ${{ !cancelled() }}
+ env:
+ CASES: ${{ inputs.alg_fuzz_cases || '1000000' }}
+ SEED: ${{ inputs.alg_fuzz_seed || '1' }}
+ JOBS: 64
+ OUT: ${{ runner.temp }}/alg-fuzz-out
+ RUSTFLAGS: -C target-cpu=native -C debug-assertions=yes
+ run: |
+ export CARGO_TARGET_DIR="$CARGO_TARGET_DIR/dbgassert"
+ cargo build --release -p differential --bin alg_fuzz
+ mkdir -p "$OUT/dbgassert"
+ rc=0
+ timeout 30m "$CARGO_TARGET_DIR/release/alg_fuzz" --random "$CASES" --seed "$SEED" --jobs "$JOBS" \
+ --out "$OUT/dbgassert" > "$OUT/dbgassert.txt" 2>&1 || rc=$?
+ [ $rc -eq 124 ] && echo "::error::debug-assert sweep timed out (hang?)"
+ tail -n 40 "$OUT/dbgassert.txt"
+ exit $rc
+ - name: summary
+ if: always()
+ env:
+ CASES: ${{ inputs.alg_fuzz_cases || '1000000' }}
+ SEED: ${{ inputs.alg_fuzz_seed || '1' }}
+ JOBS: 64
+ OUT: ${{ runner.temp }}/alg-fuzz-out
+ run: |
+ {
+ echo "### Algebraic equivalence fuzz"
+ for mode in release dbgassert; do
+ f="$OUT/$mode.txt"
+ [ -e "$f" ] || continue
+ if ! grep -q '^checked' "$f"; then
+ # alg_fuzz reports only at the end, so a killed run leaves no counts
+ echo; echo "**$mode**: no report (timed out or crashed; see the step log)"
+ continue
+ fi
+ echo
+ echo "**$mode** ($(grep -m 1 '^checked' "$f")): $(tail -n 1 "$f")"
+ echo
+ echo "findings by value type
"
+ echo
+ echo '```text'
+ sed -n '/^by value type/,/^seen under/p' "$f" | grep -v '^seen under'
+ echo '```'
+ echo "- | -> u64 {
+ it.next().and_then(|s| s.parse().ok()).unwrap_or_else(|| usage())
+ };
+ match arg.as_str() {
+ "--random" => a.random = num(&mut it) as usize,
+ "--seed" => a.seed = num(&mut it),
+ "--jobs" => a.jobs = (num(&mut it) as usize).max(1),
+ "--max-report" => a.max_report = num(&mut it) as usize,
+ "--out" => a.out = PathBuf::from(it.next().unwrap_or_else(|| usage())),
+ "--shrink" => a.shrink = Some(PathBuf::from(it.next().unwrap_or_else(|| usage()))),
+ "--shape" => a.shape_fatal = true,
+ "--strict" => a.strict = true,
+ "--target" => a.target = Some(it.next().unwrap_or_else(|| usage())),
+ "-v" | "--verbose" => a.verbose = true,
+ "-h" | "--help" => usage(),
+ s if s.starts_with('-') => usage(),
+ s => a.files.push(PathBuf::from(s)),
+ }
+ }
+ if a.random == 0 && a.files.is_empty() && a.shrink.is_none() {
+ a.random = 10_000;
+ }
+ a
+}
+
+// ------------------------------------------------------------------ driving
+
+struct Tally {
+ cases: usize,
+ by_signature: BTreeMap,
+ examples: Vec<(String, Vec, String)>,
+}
+
+impl Tally {
+ fn new() -> Tally {
+ Tally { cases: 0, by_signature: BTreeMap::new(), examples: Vec::new() }
+ }
+
+ /// Record one outcome. `cases` counts inputs, not outcomes, so only the
+ /// first value type of each input increments it.
+ fn record(&mut self, type_name: &str, bytes: &[u8], outcome: Outcome, count: bool) {
+ if count {
+ self.cases += 1;
+ }
+ let findings: Vec<(String, String)> = match outcome {
+ Outcome::Clean => return,
+ Outcome::Panicked(p, site, msg) => {
+ vec![(
+ algebraic::panic_signature(type_name, p, &site),
+ format!("panicked at {site}: {msg}"),
+ )]
+ }
+ Outcome::Diverged(d) => {
+ d.into_iter().map(|d| (d.signature, d.detail)).collect()
+ }
+ };
+ for (sig, detail) in findings {
+ let seen = self.by_signature.entry(sig.clone()).or_insert(0);
+ *seen += 1;
+ // One saved example per signature: the point of the corpus is one
+ // reproducer per distinct defect, not one per input that hits it.
+ if *seen == 1 {
+ self.examples.push((sig, bytes.to_vec(), detail));
+ }
+ }
+ }
+
+ fn merge(&mut self, other: Tally) {
+ self.cases += other.cases;
+ for (sig, n) in other.by_signature {
+ *self.by_signature.entry(sig).or_insert(0) += n;
+ }
+ for (sig, bytes, detail) in other.examples {
+ if !self.examples.iter().any(|(s, _, _)| *s == sig) {
+ self.examples.push((sig, bytes, detail));
+ }
+ }
+ }
+}
+
+fn main() {
+ let args = parse();
+
+ // Replaces the default hook, which would print a backtrace notice per
+ // panicking case and drown a long run. It also records the panic site,
+ // which `catch_unwind` alone cannot see.
+ algebraic::install_panic_hook();
+
+ if let Some(path) = &args.shrink {
+ do_shrink(path, args.target.as_deref());
+ return;
+ }
+
+ let mut tally = Tally::new();
+
+ if !args.files.is_empty() {
+ for f in &args.files {
+ let bytes = std::fs::read(f).unwrap_or_else(|e| {
+ eprintln!("{}: {e}", f.display());
+ std::process::exit(2)
+ });
+ let mut labels = Vec::new();
+ let mut first = true;
+ algebraic::run_all(&bytes, &mut |name, outcome| {
+ labels.push(match &outcome {
+ Outcome::Clean => format!("{name}: clean"),
+ Outcome::Diverged(d) => format!("{name}: {} finding(s)", d.len()),
+ Outcome::Panicked(p, site, m) => {
+ format!("{name}: panic in {} at {site}: {m}", p.tag())
+ }
+ });
+ tally.record(name, &bytes, outcome, first);
+ first = false;
+ });
+ println!("{}: {}", f.display(), labels.join(", "));
+ }
+ }
+
+ if args.random > 0 {
+ let per = args.random / args.jobs;
+ let (tx, rx) = mpsc::channel();
+ let mut handles = Vec::new();
+ for job in 0..args.jobs {
+ let tx = tx.clone();
+ let seed = args.seed;
+ let n = if job == args.jobs - 1 { args.random - per * (args.jobs - 1) } else { per };
+ handles.push(std::thread::spawn(move || {
+ let mut rng = Rng::for_job(seed, job);
+ let mut t = Tally::new();
+ for _ in 0..n {
+ let bytes = rng.input();
+ let mut first = true;
+ algebraic::run_all(&bytes, &mut |name, outcome| {
+ t.record(name, &bytes, outcome, first);
+ first = false;
+ });
+ }
+ let _ = tx.send(t);
+ }));
+ }
+ drop(tx);
+ for t in rx {
+ tally.merge(t);
+ }
+ for h in handles {
+ let _ = h.join();
+ }
+ }
+
+ report(&args, &mut tally);
+}
+
+fn report(args: &Args, tally: &mut Tally) {
+ println!("\nchecked {} case(s)", tally.cases);
+ if tally.by_signature.is_empty() {
+ println!("no divergence");
+ return;
+ }
+
+ println!("\nfindings by signature:");
+ for (sig, n) in &tally.by_signature {
+ match algebraic::known(sig) {
+ Some(k) => println!(" {n:>8} {sig} (known: {})", k.cause),
+ None => println!(" {n:>8} {sig} <-- NEW"),
+ }
+ }
+
+ value_type_comparison(tally);
+
+ if let Err(e) = std::fs::create_dir_all(&args.out) {
+ eprintln!("cannot create {}: {e}", args.out.display());
+ }
+
+ let shown = if args.verbose { tally.examples.len() } else { args.max_report.min(tally.examples.len()) };
+ println!("\nsaved reproducers in {}:", args.out.display());
+ for (i, (sig, bytes, detail)) in tally.examples.iter().enumerate() {
+ let stem = sanitize(sig);
+ let bin = args.out.join(format!("{stem}.bin"));
+ let txt = args.out.join(format!("{stem}.txt"));
+ let _ = std::fs::write(&bin, bytes);
+ // Rendering the case means building the operands again, which for a
+ // `panic:build` finding panics again. Catch it: the reproducer is
+ // still worth writing, it just cannot describe itself.
+ let described = panic::catch_unwind(AssertUnwindSafe(|| {
+ algebraic::describe_as(algebraic::value_type_of(sig), bytes)
+ }))
+ .unwrap_or_else(|_| "\n".to_string());
+ let body = format!("signature: {sig}\n\n{described}\n{detail}\n");
+ let _ = std::fs::write(&txt, &body);
+ println!(" {}", bin.display());
+ if i < shown {
+ for line in body.lines() {
+ println!(" {line}");
+ }
+ }
+ }
+
+ let fatal: Vec<&str> = tally
+ .by_signature
+ .keys()
+ .map(|s| s.as_str())
+ .filter(|sig| is_fatal(sig, args))
+ .collect();
+ if fatal.is_empty() {
+ println!("\nnothing unexpected: every signature is in algebraic::KNOWN");
+ } else {
+ println!("\n{} unexpected signature(s): {}", fatal.len(), fatal.join(" "));
+ std::process::exit(1);
+ }
+}
+
+/// Whether a signature should fail the run.
+///
+/// `--strict` fails on anything. Otherwise a signature in `algebraic::KNOWN`
+/// is excused, a panic or a wrong value is fatal, and a dangling-path-only
+/// divergence is fatal only under `--shape`.
+/// Print which findings each value type sees, which is the question the two
+/// instantiations exist to answer.
+///
+/// A signature under `u64` alone is an artefact of its lattice instances, which
+/// are not a lattice: `pjoin` and `pmeet` both return the left operand, so
+/// `a | b == a & b` and several identities cannot hold. A signature under the
+/// lawful type -- alone, or under both -- is a defect in the crate.
+///
+/// The counts matter as much as the membership. A law that fails 3000 times
+/// under `u64` and 12 times under `bits` is one defect amplified by the value
+/// type, not two findings: under a commutative join, picking the wrong operand
+/// is invisible except where one operand already contains the other, so only
+/// that residue survives.
+fn value_type_comparison(tally: &Tally) {
+ let types = algebraic::VALUE_TYPES;
+ if types.len() < 2 {
+ return;
+ }
+
+ // Strip the value-type prefix: `u64:values:pw1` -> `values:pw1`.
+ let rest = |sig: &str| sig.splitn(2, ':').nth(1).unwrap_or(sig).to_string();
+ let per_type: Vec> = types
+ .iter()
+ .map(|t| {
+ tally
+ .by_signature
+ .iter()
+ .filter(|(sig, _)| algebraic::value_type_of(sig) == *t)
+ .map(|(sig, n)| (rest(sig), *n))
+ .collect()
+ })
+ .collect();
+
+ let mut all: Vec = per_type.iter().flat_map(|m| m.keys().cloned()).collect();
+ all.sort();
+ all.dedup();
+ if all.is_empty() {
+ return;
+ }
+
+ let lawful: Vec<&str> =
+ types.iter().copied().filter(|t| *t != "u64").collect();
+ println!("\nby value type -- {} are lawful, u64 is not:", lawful.join(" and "));
+ print!(" {:<38}", "finding");
+ for t in types {
+ print!(" {t:>9}");
+ }
+ println!();
+
+ // Which types see each finding, so the groups below can be built by subset.
+ let mut by_subset: BTreeMap, Vec> = BTreeMap::new();
+ for k in &all {
+ print!(" {k:<38}");
+ let mut seen = Vec::new();
+ for (i, t) in types.iter().enumerate() {
+ match per_type[i].get(k) {
+ Some(n) => {
+ print!(" {n:>9}");
+ seen.push(*t);
+ }
+ None => print!(" {:>9}", "-"),
+ }
+ }
+ println!();
+ by_subset.entry(seen).or_default().push(k.clone());
+ }
+
+ println!("\nseen under:");
+ for (subset, findings) in &by_subset {
+ let note = if subset.len() == types.len() {
+ " <- value-independent, or one defect amplified; read the counts"
+ } else if subset == &["u64"] {
+ " <- artefacts: u64's instances are not a lattice"
+ } else if subset.contains(&"u64") {
+ ""
+ } else {
+ " <- REAL, and u64 was hiding them"
+ };
+ println!(" {:<22}{note}", subset.join(" + "));
+ for f in findings {
+ println!(" {f}");
+ }
+ }
+}
+
+fn is_fatal(sig: &str, args: &Args) -> bool {
+ if args.strict {
+ return true;
+ }
+ if algebraic::known(sig).is_some() {
+ return false;
+ }
+ // The class is the *second* field: signatures are `::...`.
+ // Matching against the start of the whole signature silently stopped working
+ // when the value-type prefix was added, which made every class fall through
+ // to "not fatal" and left the gate passing runs that had turned up new
+ // findings. Parse the field rather than the prefix.
+ let class = sig.split(':').nth(1).unwrap_or("");
+ match class {
+ "panic" => true,
+ "shape" => args.shape_fatal,
+ c => DEFAULT_FATAL.iter().any(|f| f.tag() == c),
+ }
+}
+
+fn sanitize(sig: &str) -> String {
+ sig.chars()
+ .map(|c| match c {
+ 'a'..='z' | 'A'..='Z' | '0'..='9' | '-' | '_' => c,
+ '|' => 'J',
+ '&' => 'M',
+ '^' => 'X',
+ '/' => 'R',
+ _ => '-',
+ })
+ .collect()
+}
+
+// ----------------------------------------------------------------- shrinking
+
+/// Minimise an input while it still produces the finding it started with.
+///
+/// Byte-level delta debugging, in two passes repeated to a fixed point: drop
+/// runs of bytes, then drive individual bytes towards zero. The second pass
+/// matters more than it looks -- the decoder reads path bytes modulo a small
+/// alphabet and entry counts modulo a small bound, so lowering a byte usually
+/// shrinks the *tries* rather than the input, which is what makes the saved
+/// reproducer readable.
+///
+/// The invariant preserved is the original's first signature, not its whole
+/// set: a smaller input often stops hitting the incidental extra findings, and
+/// insisting on all of them would block almost every reduction.
+fn do_shrink(path: &Path, want: Option<&str>) {
+ let original = std::fs::read(path).unwrap_or_else(|e| {
+ eprintln!("{}: {e}", path.display());
+ std::process::exit(2)
+ });
+ let sigs = signatures(&original);
+ if sigs.is_empty() {
+ eprintln!("{}: no divergence to shrink", path.display());
+ std::process::exit(2)
+ }
+ let target = match want {
+ Some(w) => {
+ if !sigs.iter().any(|s| s == w) {
+ eprintln!(
+ "{}: does not produce {w}; it produces {}",
+ path.display(),
+ sigs.join(" ")
+ );
+ std::process::exit(2)
+ }
+ w.to_string()
+ }
+ // An input usually hits several findings at once, and which one comes
+ // first is an artefact of route order. Say which was picked, so a
+ // surprising reduction is explainable rather than mysterious.
+ None => sigs[0].clone(),
+ };
+ eprintln!(
+ "shrinking {} bytes, target {target} (of {})",
+ original.len(),
+ sigs.join(" ")
+ );
+
+ let holds = |b: &[u8]| signatures(b).iter().any(|s| *s == target);
+ let mut best = original;
+
+ loop {
+ let before = (best.len(), best.iter().map(|b| *b as u32).sum::());
+
+ let mut chunk = best.len().next_power_of_two() / 2;
+ while chunk >= 1 {
+ let mut i = 0;
+ while i < best.len() {
+ let end = (i + chunk).min(best.len());
+ let mut cand = best[..i].to_vec();
+ cand.extend_from_slice(&best[end..]);
+ if !cand.is_empty() && holds(&cand) {
+ best = cand;
+ } else {
+ i += chunk;
+ }
+ }
+ chunk /= 2;
+ }
+
+ for i in 0..best.len() {
+ for v in [0u8, 1, best[i] / 2] {
+ if best[i] <= v {
+ continue;
+ }
+ let mut cand = best.clone();
+ cand[i] = v;
+ if holds(&cand) {
+ best = cand;
+ break;
+ }
+ }
+ }
+
+ if (best.len(), best.iter().map(|b| *b as u32).sum::()) == before {
+ break;
+ }
+ }
+
+ let out = path.with_extension("min.bin");
+ std::fs::write(&out, &best).unwrap();
+ eprintln!("shrunk to {} bytes -> {}", best.len(), out.display());
+
+ let described = panic::catch_unwind(AssertUnwindSafe(|| {
+ algebraic::describe_as(algebraic::value_type_of(&target), &best)
+ }))
+ .unwrap_or_else(|_| "\n".to_string());
+ print!("{described}");
+ algebraic::run_all(&best, &mut |name, outcome| match outcome {
+ Outcome::Clean => println!("{name}: no divergence"),
+ Outcome::Panicked(p, site, m) => println!("{name}: panic in {} at {site}: {m}", p.tag()),
+ Outcome::Diverged(d) => {
+ for div in d {
+ println!("[{}] {}\n{}", div.class.tag(), div.signature, div.detail);
+ }
+ }
+ });
+ let _ = std::io::stdout().flush();
+}
diff --git a/differential/src/bin/alg_lattice_check.rs b/differential/src/bin/alg_lattice_check.rs
new file mode 100644
index 00000000..95f5c6e3
--- /dev/null
+++ b/differential/src/bin/alg_lattice_check.rs
@@ -0,0 +1,208 @@
+//! Is a divergence the crate's fault, or the value type's?
+//!
+//! `(a | b) \ (a & b)` and `(a \ b) | (b \ a)` are equal in any distributive
+//! lattice with a relative complement, so a divergence between them is never a
+//! matter of convention. This prints both formulas for several value types and
+//! shows which ones are lawful.
+//!
+//! It also asks a second question, which turns out to be the more important one
+//! for fuzzing: does the type's `pjoin`/`pmeet`/`psubtract` ever return
+//! `AlgebraicResult::Element` -- a combined value that is not simply one of its
+//! operands? If not, every code path that *stores* a combined value is
+//! unreachable from that type, however lawful it is.
+//!
+//! ```sh
+//! cargo run --release -p differential --bin alg_lattice_check
+//! ```
+
+use core::fmt::Debug;
+use pathmap::ring::{AlgebraicResult, DistributiveLattice, Lattice, COUNTER_IDENT, SELF_IDENT};
+use pathmap::utils::ByteMask;
+
+/// Bottom is `None`, as it is everywhere in `pathmap`: a value that cancels
+/// becomes an absent value, not a present zero. Resolving through `Option`
+/// uses the crate's own `Option` lattice impls, so this says nothing the
+/// trie does not.
+fn resolve(r: AlgebraicResult>, l: &Option, rr: &Option) -> Option {
+ match r {
+ AlgebraicResult::Element(v) => v,
+ AlgebraicResult::Identity(m) => {
+ if m & SELF_IDENT != 0 { l.clone() } else { rr.clone() }
+ }
+ AlgebraicResult::None => None,
+ }
+}
+
+fn show(v: &Option) -> String {
+ match v {
+ None => "BOTTOM".to_string(),
+ Some(v) => format!("{v:?}"),
+ }
+}
+
+/// `(a | b) \ (a & b)` and `(a \ b) | (b \ a)`, each resolved to a value.
+fn two_formulas(a: T, b: T) -> (String, String, String, String, bool)
+where
+ T: Lattice + DistributiveLattice + Clone + Debug,
+{
+ let (ao, bo) = (Some(a), Some(b));
+ let j = resolve(ao.pjoin(&bo), &ao, &bo);
+ let m = resolve(ao.pmeet(&bo), &ao, &bo);
+ let f1 = resolve(j.psubtract(&m), &j, &m);
+
+ let ab = resolve(ao.psubtract(&bo), &ao, &bo);
+ let ba = resolve(bo.psubtract(&ao), &bo, &ao);
+ let f2 = resolve(ab.pjoin(&ba), &ab, &ba);
+
+ let agree = show(&f1) == show(&f2);
+ (show(&j), show(&m), show(&f1), show(&f2), agree)
+}
+
+fn row(label: String, a: T, b: T)
+where
+ T: Lattice + DistributiveLattice + Clone + Debug,
+{
+ let (j, m, f1, f2, agree) = two_formulas(a, b);
+ println!(
+ " {label:<22} a|b = {j:>9} a&b = {m:>9} (a|b)-(a&b) = {f1:>9} (a-b)|(b-a) = {f2:>9} {}",
+ if agree { "agree" } else { "DIVERGE" }
+ );
+}
+
+/// Whether each operation ever returns `Element` over a sample of pairs.
+fn element_per_op