Decomposition-Based Checking and Local Certification for Propositional Circumscription via Minimal Reducts

Abstract

Propositional circumscription selects models that are minimal with respect to designated atoms while permitting another set of atoms to vary. For a clause theory $\phi$, minimized atoms P, varied atoms Z, and a candidate interpretation M, the minimal-reduct characterization reduces candidate-model checking to the entailment $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge (M\cap P)$. We establish a structural decomposition of this entailment using the collapsed negative dependency graph of the reduct. Each selected source component induces a scoped entailment, and the global entailment is equivalent to the finite sequence of local obligations generated by successive contraction. The proof combines graph-based source selection, constructive extension of scoped countermodels, and preservation under contraction. These results yield a sound and complete checker that contracts certified minimized atoms and records origin-preserving certificate fragments over the original clauses. We instantiate the framework by direct SAT-based entailment checking and MUS-based support extraction. Experiments on 5445 random 3CNF instances and 462 industrial CNF instances show complete agreement with the global reduct criterion, and every generated certificate is successfully replayed. MUS-based extraction reduces the mean accumulated support size by $97.4\%$ and $99.85\%$ on the two benchmark collections, respectively, while incurring additional running time. The results provide a formal basis for local, replayable certification of propositional circumscription models.

1. Introduction

Circumscription is a foundational formalism of non-monotonic reasoning. It was introduced to represent closed-world and common-sense assumptions by minimizing designated predicates subject to a background theory [1,2,3,4]. In the propositional setting, the atoms are divided into minimized, varied, and fixed classes. A selected model admits no strictly preferable competing model that preserves the fixed part of the interpretation while decreasing the minimized part; the varied atoms remain unconstrained by the comparison. This semantics provides a concise account of defeasible conclusions, but it also makes model checking a global task over alternative interpretations.

Most computational work on propositional circumscription has therefore concentrated on deciding whether a candidate is minimal, generating circumscribed models, or compiling circumscription into another reasoning formalism. Representative approaches employ predicate elimination, translations to logic programming, SAT- and MaxSAT-based encodings, or structural restrictions on the input theory [5,6,7,8,9,10]. The complexity of the underlying inference and candidate-model checking tasks has been analyzed separately for propositional circumscription and closely related closed-world formalisms [11,12,13]. These methods provide powerful decision procedures. A Boolean answer alone, however, does not show which clauses force the minimized atoms of the candidate, how the relevant constraints interact, or how the result can be checked independently of the solver that produced it.

Recent research in mathematical logic has examined formal relationships between axiomatic and rule-based presentations, cut-free proof systems, and algorithmic model checking. Borrego-Díaz et al. [14] establish conservativity results for theories extended by conditional axioms and their associated inference rules. Lin and Ma [15] develop cut-free Gentzen sequent calculi for tense logics. In a different setting, Yu et al. [16] define a fuzzy computation-tree temporal logic with quality constraints and provide a model-checking algorithm together with its complexity analysis. These studies concern logical formalisms distinct from circumscription and are cited as recent examples of mathematical investigations into proof systems and logical decision procedures. The present work focuses specifically on candidate-relative certification for propositional circumscription, where a global minimality judgment is decomposed into local entailment obligations that can be independently reconstructed and checked.

This limitation is significant in verification-oriented applications. A result used in formal verification, knowledge-base maintenance, or solver validation should preferably be accompanied by a finite object whose correctness can be checked by a separate and comparatively simple procedure. For circumscription, such an object must retain the connection between the global minimality condition and the original clauses. Merely returning a collection of clauses is insufficient: the certificate must identify the obligation proved by those clauses and specify how a sequence of local proofs establishes the global result. We refer to a certificate with this property as replayable.

The starting point of this paper is the minimal-reduct characterization of propositional circumscription [17]. Let $\phi$ be a clause theory, let P and Z denote the minimized and varied atoms, respectively, and let M be a candidate interpretation. The characterization reduces circumscription model checking to a classical entailment:

$$M\vDash \mathrm{CIRC}[\phi ;P;Z]⟺\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge (M\cap P).$$

(1)

The reduct discards clauses and literals that cannot participate in an admissible countermodel below the candidate. The remaining entailment is still global, but it has a purely propositional form and is therefore a suitable object for structural analysis.

Our aim is to decompose this entailment into a sequence of smaller obligations without weakening the equivalence above. This cannot be achieved by an arbitrary partition of the residual clauses. A correct decomposition must identify the part of the reduct relevant to a current block of minimized atoms, establish that clauses outside that part cannot affect the local entailment, and preserve the remaining global obligation after the verified atoms have been contracted. The construction must also account for source components containing only varied literals and must maintain a precise correspondence between residual clauses and their origins in the input theory. These requirements specify the mathematical conditions under which the decomposition is valid.

We organize the residual dependencies through a collapsed negative dependency graph. Its strongly connected components represent groups of literals tied by cyclic negative dependencies. At each stage, source components whose labels are disjoint from the current verification target are pruned from the working graph. A remaining source component with non-empty target intersection then determines the next local obligation together with the residual clauses in its dependency scope. After that obligation has been certified, the verified minimized atoms are contracted, the reduct and graph are recomputed, and the construction continues. The main theorem proves that this process terminates and that the resulting local obligations are jointly equivalent to the original reduct entailment.

The proof separates four issues that are easily conflated in an algorithmic description. First, pruning must expose a source with a non-empty minimized target whenever such targets remain. Second, the selected scope must be semantically closed for the local obligation. Third, contraction must preserve exactly the unresolved part of the global entailment. Fourth, clause origins must remain well defined when residual clauses are simplified, deleted, or merged. Formalizing these points yields a decomposition theorem, a sound and complete checking procedure, and an implementation-independent replay relation.

A successful run records the selected components and clause supports needed for their local entailments. During replay, the checker reconstructs the current reduct, graph, scope, and target from the candidate and the previously verified steps. Consequently, the persistent certificate need not store implementation-specific graph identifiers or intermediate residual theories. A failed local obligation produces a local countermodel, which supplies a checkable explanation of why the corresponding global test fails.

We consider two certification strategies. The direct SAT-based strategy checks each scoped entailment and retains the complete scoped support. The MUS-based strategy extracts an inclusion-minimal unsatisfiable subtheory before mapping the selected residual clauses back to their original clauses. Both strategies implement the same semantics and return the same checking result. Their difference concerns the proof object: MUS extraction usually provides a much smaller certificate at the cost of additional computation. Accordingly, the proposed framework is intended for local and replayable certification. It is not claimed to improve the running time of a global reduct checker when only the Boolean decision is required. The term local certification refers to the construction and independent validation of local proof obligations; the candidate interpretation itself is not modified.

The principal contributions are as follows.

(i)

We give a graph-theoretic decomposition of the minimal-reduct entailment used in propositional circumscription checking. The formal development includes source exposure after pruning, semantic separation of local scopes, and preservation under successive contraction.

(ii)

We derive a sound and complete source-component checker and define an origin-preserving certificate format with an independent replay procedure. The construction specifies a canonical encoding of stage-local dependency blocks and a representative origin map that remains well defined under residual simplification and duplicate-clause merging.

(iii)

We instantiate the framework with SAT-based and MUS-based certification and compare both variants with the global reduct criterion on random and industrial CNF benchmarks. The evaluation measures decision agreement, locality, certificate size, replayability, and computational overhead.

The remainder of the paper is organized as follows. Section 2 reviews circumscription computation, minimal reducts, graph-based minimal-model construction, structural decomposition, and certificate-oriented reasoning. Section 3 introduces the formal setting. Section 4 develops the graph construction and proves the decomposition results. Section 5 presents the checker, certificate format, and certification procedures. Section 6 reports the experimental evaluation. Section 7 discusses the scope and limitations of the framework, and Section 8 concludes the paper.

2. Related Work

Circumscription was introduced by McCarthy as a second-order formalization of predicate minimization and subsequently developed as a general mechanism for non-monotonic knowledge representation [2,3]. Its computational study has included predicate elimination, reductions to propositional satisfiability, complexity analyses, candidate-model checking, and translations into logic programming [5,6,7,8,9,18,19,20,21]. Eiter and Gottlob characterize the complexity of propositional circumscription and extended closed-world reasoning [11], while Cadoli studies the complexity of checking models of circumscriptive formulae [12]. A broader account of complexity results for non-monotonic logics is given by Cadoli and Schaerf [13]. Related closed-world formalisms include the weak generalized closed-world assumption of Rajasekar et al. [22]. These works principally address the computation or complexity of circumscribed and closed-world consequences, rather than the construction of replayable local certificates for a fixed candidate model.

Reduct constructions provide a closely related semantic technique. They are fundamental to stable-model semantics, and their relationship with circumscription has been investigated in both propositional and first-order settings [23,24]. Dependency graphs and loop formulas further expose cyclic structure and reduce non-monotonic conditions to classical constraints [25]. For propositional circumscription, the minimal reduct of [17] is defined relative to a candidate interpretation and isolates the residual constraints relevant to the existence of a strictly preferred model. This characterization converts candidate minimality into a classical entailment problem.

Structural decomposition has also been studied extensively in logic programming and minimal-model reasoning. Dependency-based methods divide a reasoning task according to strongly connected components, program modules, or problem-specific structural partitions [26,27,28]. In answer set programming, such methods are generally formulated with respect to stable-model semantics and the rule dependency structure of the input program. Their purpose ranges from modular evaluation to search-space reduction and distributed solving.

A particularly relevant contribution is the graph-based construction of minimal models proposed by Angiulli et al. [29]. Their framework considers positive propositional theories represented by rules and forms a super-dependency graph from the strongly connected components of the associated atom–clause dependency graph. Given a source component S, the projected theory $T^S$ is solved first; if X is a minimal model of $T^S$, the assignment on S is propagated by $Reduce(T,X,S\backslash X)$. Their composition theorem shows that X can be combined with a minimal model of the reduced theory to obtain a minimal model of T. Iteration yields the algorithm ModuMin. Its worst-case bound is expressed in terms of the largest component on which a complete minimal-model procedure is required, and source theories belonging to the HCF or HEF classes can be handled in polynomial time by the incomplete subprocedure used in the algorithm. Distinct non-trivial sources may be processed in parallel, and the residual theory is independent of the order in which the corresponding reductions are applied. The same paper derives an ordinary minimal-model checking procedure by restricting a positive theory to subsets of a candidate model and invoking ModuMin. It also observes that, although ModuMin always returns a minimal model, it need not generate every minimal model; sufficient conditions for generative completeness are formulated through the modular and one-source-head properties.

Proof-producing reasoning provides a complementary line of work. From a proof-complexity perspective, Beyersdorff and Chew [30] compare sequent-style and tableau calculi for propositional circumscription and establish strict separations in proof strength and exponential lower bounds for selected systems. Their analysis concerns the size of formal derivations, whereas the present work constructs candidate-relative local supports that can be reconstructed and replayed from the original theory.

SAT and MaxSAT cores, proof logging, and inconsistency certificates supply evidence that can be checked independently of the original solver [31,32,33,34,35]. At the level of mathematical proof systems, conservativity between axiomatic and rule-based presentations and cut-free sequent calculi provide related accounts of how semantic validity can be represented by explicit derivations [14,15]. These results do not yield circumscription certificates, but they clarify the distinction between a semantic consequence and a structured proof object witnessing that consequence. Justifications, explanations, and witness structures have likewise been developed for answer-set semantics [36,37,38,39,40,41]. These approaches establish the broader methodological basis for replacing an unverifiable Boolean answer with a compact semantic or solver-level object.

The closest connection with [29] concerns recursive graph-guided simplification. Both frameworks use a condensation DAG, select structurally exposed components, and simplify a residual theory after processing the selected component. The invariant maintained by the recursion is different. In the construction of Angiulli et al., the selected source is assigned a locally computed minimal model, and the composition theorem preserves the existence and minimality of the model assembled from the local assignment and a residual minimal model. In the present setting, the candidate interpretation is fixed before decomposition. A selected component C is accepted only after the scoped entailment establishes that every model of the corresponding local reduct satisfies every atom in ${\Delta }_C$. Contraction therefore records a proved consequence of the reduct; it does not select a local assignment from among alternative minimal models.

This difference prevents a direct application of the minimal-model construction theorem to the minimal reduct. The framework of Angiulli et al. uses positive theories and ordinary set-inclusion minimality over all atoms. A minimal reduct in the present setting may contain constraint clauses and signed occurrences of varied atoms, while the circumscription order minimizes only the atoms in P and leaves the atoms in Z free to change. Treating the reduct as an ordinary minimal-model problem would consequently minimize the varied atoms as well, unless an additional semantic encoding were introduced. More importantly, the target condition is the skeptical entailment $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge (M\cap P)$. Computing one minimal model of the reduct cannot decide this condition, since another minimal model may omit an atom of $M\cap P$. The auxiliary checking construction of [29] addresses ordinary minimality of a fixed model by restricting the search to its subsets; it does not provide a decomposition of this candidate-relative entailment with varied atoms.

The graph-theoretic locality required by the two methods also differs. In [29], a source is an SCC of the atom–clause dependency graph, and the local theory is the projection whose clauses use only atoms of that source. In the collapsed negative dependency graph used here, the vertex set is $R\cup Z\cup \neg Z$, where R is the current verification target. After empty sources are pruned, a component containing minimized atoms may remain dependent on ancestors consisting solely of varied literals. Its local obligation must therefore be evaluated over an atom-completed ancestor scope rather than over the component projection alone. The scoped-countermodel extension lemma supplies the formal condition under which clauses outside that scope are irrelevant to the selected entailment. After a successful obligation, ${\Delta }_C$ is removed from R, and both the reduct and its graph are recomputed; correctness is derived from the two model-transfer propositions, without assuming the commutativity property of the Reduce steps established for parallel sources in [29].

These distinctions also delimit the algorithmic claims. The component-sensitive bound and the HCF/HEF tractability results of ModuMin concern the construction of a minimal model of a positive theory and do not transfer to the local entailment tests considered here, which retain the complexity of propositional entailment and may incur further cost from MUS extraction. The purpose of the present decomposition is therefore structural localization and independently replayable certification. It yields a sound and complete decision procedure for the fixed circumscription candidate, together with an origin-preserving sequence of local supports or a scoped countermodel. This contrasts with the generative objective of ModuMin, whose output is a minimal model and whose ability to generate all minimal models requires additional structural conditions.

3. Preliminaries

Let $\mathcal{L}$ be a propositional language over a finite set $\mathcal{A}$ of atoms. The constants ⊥ and ⊤ are also allowed. A literal is an atom $p\in \mathcal{A}$ or its negation $\neg p$. A clause is a finite set of literals, identified with the disjunction of its elements. The empty clause is identified with ⊥. A clause theory is a finite set of clauses, identified with their conjunction. For a clause $\alpha$, we write

$${\alpha }^{+}=\mathcal{A}\cap \alpha ,{\alpha }^{-}=\{p\in \mathcal{A}\mid \neg p\in \alpha \}.$$

For $S\subseteq \mathcal{A}$, let $\overline{S}=\mathcal{A}\backslash S$, $\neg S=\{\neg p\mid p\in S\}$, $\bigvee S={\bigvee }_{p\in S}p$, and $\bigwedge S={\bigwedge }_{p\in S}p$. An interpretation is identified with the set of atoms assigned true. Classical satisfaction is denoted by ⊧.

As usual in propositional circumscription, quantification over propositional variables is shorthand for expansion over the truth constants. Thus, if $A(z,p_1,\dots ,p_k)$ is a propositional formula, $\exists zA(z,p_1,\dots ,p_k)$ denotes $A(\top ,p_1,\dots ,p_k)\vee A(\perp ,p_1,\dots ,p_k)$, and $\forall zA(z,p_1,\dots ,p_k)$ is defined dually. The notation extends componentwise to tuples.

In the following, tuples of atoms are used for simultaneous replacement. We identify a tuple with the corresponding set when this causes no confusion. For instance, if $P=(p_1,\dots ,p_m)$ and $Z=(z_1,\dots ,z_n)$, then expressions such as $p\in P$, $P\cap M$, and $\mathcal{A}\backslash (P\cup Z)$ refer to the underlying sets of atoms. If $X=(x_1,\dots ,x_m)$ and $Y=(y_1,\dots ,y_n)$ are tuples of propositional variables of the same lengths as P and Z, respectively, then $\phi (X,Y)$ denotes the result of simultaneously replacing every $p_i$ in $\phi (P,Z)$ by $x_i$ and every $z_j$ by $y_j$. Atoms outside $P\cup Z$ are not replaced.

For tuples $P=(p_1,\dots ,p_m)$ and $X=(x_1,\dots ,x_m)$, define

$$X\le P:={\displaystyle \underset{i=1}{\overset{m}{\bigwedge }}}(x_i\to p_i),$$

(2)

$$X=P:={\displaystyle \underset{i=1}{\overset{m}{\bigwedge }}}(x_i\leftrightarrow p_i),$$

(3)

$$X<P:=(X\le P)\wedge \neg (X=P).$$

(4)

Thus $X<P$ is a formula expressing that the comparison tuple is componentwise no larger than P and strictly smaller in at least one component.

Example 1. 

Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and clause theory

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

When simultaneous replacement is used, take the displayed orders $P=(p_1,p_2,p_3)$ and $Z=\left(z_1\right)$. If $X=(x_1,x_2,x_3)$ and $Y=\left(y_1\right)$, then $\phi (X,Y)$ is the clause theory

$$\{\neg x_1\vee x_2,x_1\vee \neg x_2,x_1\vee \neg x_3,x_3\vee y_1\}.$$

No atom outside $P\cup Z$ occurs in this example; in general, such atoms are not replaced.

Definition 1 

(Parallel circumscription). Let P and Z be disjoint tuples of atoms, and $\phi (P,Z)$ be a propositional formula. The parallel circumscription of P in φ with Z allowed to vary is

$$\mathrm{CIRC}[\phi (P,Z);P;Z]:=\phi (P,Z)\wedge \neg \exists X\exists Y\left(\phi (X,Y)\wedge X<P\right).$$

(5)

When $Z=\varnothing$, we write $\mathrm{CIRC}[\phi ;P]$.

The atoms in P are minimized, the atoms in Z are varied, and the atoms in $\mathcal{A}\backslash (P\cup Z)$ are fixed. The following model-theoretic order is the semantic counterpart of the syntactic comparison $X<P$.

Definition 2 

(Interpretation ordering). Let $P,Z\subseteq \mathcal{A}$ be disjoint, and $M,N\subseteq \mathcal{A}$ be interpretations. We write $N{\le }^{P;Z}M$ if

$$N\cap P\subseteq M\cap P\mathrm{and}N\backslash (P\cup Z)=M\backslash (P\cup Z).$$

We write $N{<}^{P;Z}M$ if $N{\le }^{P;Z}M$ and $M{/\le }^{P;Z}N$.

The relation ${\le }^{P;Z}$ separates the two semantic requirements of circumscription: containment on the minimized atoms and agreement on the fixed atoms. Its strict part therefore identifies exactly the interpretations that can refute the minimality of a candidate. The next definition uses this order to state the model condition independently of the second-order presentation in Definition 1.

Definition 3 

(Circumscription model). An interpretation M is a model of $\mathrm{CIRC}[\phi ;P;Z]$, written $M\vDash \mathrm{CIRC}[\phi ;P;Z]$, if $M\vDash \phi$ and there is no model N of φ such that $N{<}^{P;Z}M$.

Definitions 1–3 give syntactic and model-theoretic presentations of the same minimization principle. The model-theoretic form will be used in the reduct proofs, because it makes the construction of a smaller countermodel explicit. The following example isolates the role of the varied atoms in that comparison.

Example 2 

(Effect of varied atoms). Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and clause theory

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

The interpretation $M=\{p_1,p_2,p_3\}$ satisfies φ. However, $N=\left\{z_1\right\}$ also satisfies φ, and

$$N\cap P=\varnothing ⊊P=M\cap P,N\backslash (P\cup Z)=M\backslash (P\cup Z)=\varnothing .$$

Thus $N{<}^{P;Z}M$. The atom $z_1$ is allowed to change because it is varied, while the minimized atoms in P become strictly smaller. Hence M is not a model of $\mathrm{CIRC}[\phi ;P;Z]$.

The syntactic formula $X<P$ and the semantic relation ${<}^{P;Z}$ will be used in different contexts: the former occurs in the second-order definition of circumscription, while the latter compares interpretations. In the decomposition and certification sections, $R\subseteq M\cap P$ denotes the current verification target. Initially $R=M\cap P$; after a certified block $\Delta \subseteq R$ is contracted, the target is updated to $R\backslash \Delta$. When a statement concerns an arbitrary set $R\subseteq P$, this is specified explicitly. In $\mathrm{Red}[\phi ;R;Z,M]$, R denotes the set of minimized atoms, and atoms in $P\backslash R$ are treated as fixed.

3.1. Minimal Reducts

The minimal reduct used below is the reduct for propositional circumscription introduced in [17]. It is used here as a model-checking device: relative to a candidate interpretation, it keeps precisely the residual clauses that may still rule out interpretations smaller under ${<}^{P;Z}$.

Definition 4 

(Minimal reduct). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ which are all disjoint, and $M\subseteq \mathcal{A}$ be an interpretation. For each clause $\alpha \in \phi$, define

$$\mathrm{Red}[\alpha ;P;Z,M]=\left({\alpha }^{+}\cap ((P\cap M)\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap ((P\cap M)\cup Z)\right)$$

(6)

provided that the following conditions hold:

(i) 

${\alpha }^{-}\cap P\cap \overline{M}=\varnothing$;

(ii) 

${\alpha }^{+}\cap \overline{P\cup Z}\cap M=\varnothing$;

(iii) 

${\alpha }^{-}\cap \overline{P\cup Z}\cap \overline{M}=\varnothing$.

If one of these conditions fails, set $\mathrm{Red}[\alpha ;P;Z,M]=\top$, meaning that the clause is omitted from the reduct. The minimal reduct of φ with respect to $P,Z,M$ is

$$\mathrm{Red}[\phi ;P;Z,M]=\left\{\mathrm{Red}\right[\alpha ;P;Z,M]\mid \alpha \in \phi ,\mathrm{Red}[\alpha ;P;Z,M]\ne \top \}.$$

The three side conditions distinguish the literals that can be evaluated from those that must remain in the residual theory. Condition (i) removes clauses already satisfied by a minimized atom that is false in the candidate; conditions (ii) and (iii) evaluate the fixed atoms according to M. The retained clause therefore contains only literals whose values may still vary in a comparison below M.

Every atom occurring in the reduct belongs to $(P\cap M)\cup Z$. Fixed atoms are evaluated according to M, and minimized atoms false in M cannot become true in an interpretation smaller than M on P.

Example 3. 

Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and clause theory

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

For the candidate interpretation $M=\{p_1,p_2,p_3\}$, we have $P\cap M=P$, and there are no fixed atoms in this example. Hence each clause satisfies the side conditions of Definition 4, and

$$\mathrm{Red}[\phi ;P;Z,M]=\phi .$$

For comparison, if $N=\left\{z_1\right\}$, then $P\cap N=\varnothing$. The clauses ${\alpha }_1$, ${\alpha }_2$, and ${\alpha }_3$ are omitted by condition (i), while ${\alpha }_4=p_3\vee z_1$ reduces to $z_1$. Thus

$$\mathrm{Red}[\phi ;P;Z,N]=\left\{z_1\right\}.$$

The reduct is therefore determined jointly by the candidate interpretation and by the roles of minimized and varied atoms.

Propositions 1 and 2 establish the two model-transfer directions used in the reduct characterization.

Proposition 1 

(Preservation of smaller models). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M].$$

If $N\vDash \phi$ and $N{<}^{P;Z}M$, then $N\vDash \psi$.

Proof. 

Let $\gamma \in \mathrm{Red}[\phi ;P;Z,M]$ be derived from a clause $\alpha \in \phi$. Thus

$$\gamma =\left({\alpha }^{+}\cap ((P\cap M)\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap ((P\cap M)\cup Z)\right),$$

and the three side conditions in Definition 4 hold for $\alpha$. Suppose, for a contradiction, that $N/\vDash \gamma$. Then

$$N\cap \left({\alpha }^{+}\cap ((P\cap M)\cup Z)\right)=\varnothing \mathrm{and}{\alpha }^{-}\cap ((P\cap M)\cup Z)\subseteq N.$$

We show that all omitted literals of $\alpha$ are false in N as well. Since $N{<}^{P;Z}M$, we have $N\cap P\subseteq M\cap P$ and $N\backslash (P\cup Z)=M\backslash (P\cup Z)$. For positive atoms omitted from $\gamma$,

$${\alpha }^{+}\backslash ((P\cap M)\cup Z)\subseteq (P\backslash M)\cup \overline{P\cup Z}.$$

The part in $P\backslash M$ is false in N because $N\cap P\subseteq M\cap P$, and the fixed part ${\alpha }^{+}\cap \overline{P\cup Z}$ is false in N by agreement with M together with condition (ii), namely ${\alpha }^{+}\cap \overline{P\cup Z}\cap M=\varnothing$. Hence no positive literal of $\alpha$ is true in N.

For negative literals omitted from $\gamma$, condition (i) gives ${\alpha }^{-}\cap P\cap \overline{M}=\varnothing$; hence no negative minimized atom false in M is omitted. The remaining omitted negative atoms are fixed atoms outside $P\cup Z$. By the fixed-atom agreement between N and M, condition (iii), ${\alpha }^{-}\cap \overline{P\cup Z}\cap \overline{M}=\varnothing$, implies that each such atom is true in N. Therefore every omitted negative literal is false in N. Together with $N/\vDash \gamma$, this yields $N/\vDash \alpha$, contradicting $N\vDash \phi$. Thus $N\vDash \gamma$, and since $\gamma$ was arbitrary, $N\vDash \mathrm{Red}[\phi ;P;Z,M]$.    □

The converse transfer is stated next for an arbitrary set $R\subseteq P$ of minimized atoms.

Proposition 2 

(Lifting reduct models). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$R\subseteq P,{\psi }_R=\mathrm{Red}[\phi ;R;Z,M].$$

If $N{\le }^{R;Z}M$ and $N\vDash {\psi }_R$, then $N\vDash \phi$.

Proof. 

Let $\alpha \in \phi$. We prove that $N\vDash \alpha$.

If $\mathrm{Red}[\alpha ;R;Z,M]\ne \top$, then $N\vDash \mathrm{Red}[\alpha ;R;Z,M]$. Since $\mathrm{Red}[\alpha ;R;Z,M]$ is obtained from $\alpha$ by deleting literals and leaving the retained literals unchanged, any retained literal satisfying the reduct clause is also a literal of $\alpha$. Hence $N\vDash \alpha$.

It remains to consider the case $\mathrm{Red}[\alpha ;R;Z,M]=\top$. Then at least one side condition in Definition 4 fails. If condition (i) fails, there is an atom $p\in {\alpha }^{-}\cap R\cap \overline{M}$. Since $N\cap R\subseteq M\cap R$, we have $p\notin N$, and therefore the literal $\neg p$ satisfies $\alpha$. If condition (ii) fails, there is an atom $p\in {\alpha }^{+}\cap \overline{R\cup Z}\cap M$. Because p is fixed with respect to $R,Z$, the equality $N\backslash (R\cup Z)=M\backslash (R\cup Z)$ gives $p\in N$, so p satisfies $\alpha$. If condition (iii) fails, there is an atom $p\in {\alpha }^{-}\cap \overline{R\cup Z}\cap \overline{M}$. Again p is fixed, whence $p\notin N$, and $\neg p$ satisfies $\alpha$. In all cases $N\vDash \alpha$. Since $\alpha$ was arbitrary, $N\vDash \phi$.    □

The preceding propositions establish the semantic correspondence needed for model checking. A strictly smaller model of the original theory satisfies the reduct, while an appropriately bounded model of the reduct lifts to a model of the original theory. The next proposition records a separate stability property: once atoms have been removed from the minimized set, recomputing the reduct does not depend on whether the removal is performed in one step or in several steps.

The reduct is compositional under successive restriction of the set of minimized atoms.

Proposition 3 

(Iterated reduct consistency). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R\subseteq P\cap M.$$

Then

$$\mathrm{Red}[\psi ;R;Z,M]\equiv \mathrm{Red}[\phi ;R;Z,M],$$

where equivalence is understood after removing clauses reduced to ⊤ and ignoring duplicate clauses. More generally, if $R_2\subseteq R_1\subseteq P\cap M$, then

$$\mathrm{Red}[\mathrm{Red}[\phi ;R_1;Z,M];R_2;Z,M]\equiv \mathrm{Red}[\phi ;R_2;Z,M].$$

Proof. 

It is enough to prove the general statement. Fix a clause $\alpha \in \phi$. The one-step reduct $\mathrm{Red}[\alpha ;R_2;Z,M]$ retains exactly the literals of $\alpha$ whose atoms belong to $(R_2\cap M)\cup Z=R_2\cup Z$, provided that no omitted literal is already forced to make $\alpha$ true or false by the side conditions of Definition 4.

Consider instead the two-step reduction through $R_1$. The first reduction retains only literals over $R_1\cup Z$. The second reduction then evaluates every atom in $R_1\backslash R_2$ according to M and retains only literals over $R_2\cup Z$. Since $R_2\subseteq R_1\subseteq M$, a positive occurrence of an atom in $R_1\backslash R_2$ is treated exactly as a fixed positive atom true in M, and a negative occurrence of such an atom is treated exactly as a fixed negative literal false in M. Therefore the side conditions that omit a clause in the two-step procedure are triggered precisely in the cases in which the corresponding side condition is triggered by the one-step reduction to $R_2$. If the clause is not omitted, the retained literals after both procedures are precisely

$$\left({\alpha }^{+}\cap (R_2\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap (R_2\cup Z)\right).$$

Thus the two reductions produce the same residual clause, or both omit it. Applying this clause-wise argument to every $\alpha \in \phi$ proves the claim.    □

Combining Propositions 1 and 2 yields the following characterization.

Theorem 1 

(Reduct characterization). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P.$$

The following statements are equivalent:

(i) 

$M\vDash \mathrm{CIRC}[\phi ;P;Z]$;

(ii) 

$\psi \vDash \bigwedge R$;

(iii) 

$R=\{p\in P\mid \psi \vDash p\}$.

Proof. 

Assume first that $M\vDash \mathrm{CIRC}[\phi ;P;Z]$ and that (ii) fails. Then there is an interpretation I satisfying $\mathrm{Red}[\phi ;P;Z,M]$ and falsifying some $p\in M\cap P$. Define

$$N=(I\cap ((P\cap M)\cup Z\left)\right)\cup (M\backslash (P\cup Z\left)\right).$$

The reduct contains only atoms from $(P\cap M)\cup Z$, so $N\vDash \mathrm{Red}[\phi ;P;Z,M]$. Moreover, $N{\le }^{P;Z}M$, and the containment on P is strict because $p\notin N$. By Proposition 2, $N\vDash \phi$. Hence $N{<}^{P;Z}M$ is a smaller model of the original theory, contradicting $M\vDash \mathrm{CIRC}[\phi ;P;Z]$.

Conversely, assume (ii), and suppose that M is not a circumscription model. Then there exists $N\vDash \phi$ such that $N{<}^{P;Z}M$. By Proposition 1, $N\vDash \mathrm{Red}[\phi ;P;Z,M]$. Since $N\cap P⊊M\cap P$, some atom in $M\cap P$ is false in N, contradicting (ii). Thus (i) and (ii) are equivalent. Finally, (ii) implies (iii) because every atom of $R=M\cap P$ is entailed by $\psi$, while for each $p\in P\backslash R$ the interpretation M is a model of $\psi$ and falsifies p; hence $\psi /\vDash p$. The converse implication is immediate. This proves the theorem.    □

Theorem 1 is the semantic point of departure for the remainder of the paper. It replaces comparison with all ${<}^{P;Z}$-smaller models by a single classical entailment problem. The decomposition developed below therefore has to preserve the models of the minimal reduct and the entailment of the atoms in $M\cap P$.

Example 4 

(Cont. Example 3). Let $M=\{p_1,p_2,p_3\}$. Since $\mathrm{Red}[\phi ;P;Z,M]=\phi$, the interpretation $N=\left\{z_1\right\}$ is a model of the reduct. In particular,

$$N/\vDash p_1,N/\vDash p_2,N/\vDash p_3.$$

Therefore $\mathrm{Red}[\phi ;P;Z,M]/\vDash \bigwedge P\cap M$. By Theorem 1, M is not a circumscription model. This is the entailment-form version of the comparison $\left\{z_1\right\}{<}^{P;Z}\{p_1,p_2,p_3\}$ from Example 2.

By Theorem 1, model checking is reduced to a classical entailment over the minimal reduct. The dependency structure used below is defined on the literals represented by the vertex set $R\cup Z\cup \neg Z$.

3.2. Dependency Graphs

We use the negative dependency convention of [25,26].

In the graph below, minimized atoms occur as positive vertices, whereas varied atoms occur as both signed vertices. Membership in induced subtheories is determined by underlying atoms.

Definition 5  

((Negative) dependency graph). Let φ be a clause theory and P and Z be two disjoint sets of atoms. The negative dependency graph of φ on P with Z is the directed graph

$${\mathbb{G}}_{\phi [P;Z]}=(V,E),$$

where

$$V=P\cup Z\cup \neg Z$$

and

$$E=\{(l_1,l_2)\mid \exists \alpha \in \phi \mathit{such}\mathit{that}\{\neg l_1,l_2\}\subseteq \alpha \}.$$

Here $\neg (\neg z)$ is identified with z for $z\in Z$. Thus, for example, a clause containing z and p induces the edge $\neg z\to p$.

An edge $l_1\to l_2$ records that a clause can transmit the failure of $l_1$ to the requirement represented by $l_2$. Strongly connected components collect mutually dependent signed vertices, and the collapsed DAG orders the resulting dependency blocks. This order will later determine which sets of minimized atoms may be verified and contracted first.

Given a circumscription $\mathrm{CIRC}[\phi ;P;Z]$ and a non-empty set $L\subseteq P$, L is called a loop of $\mathrm{CIRC}[\phi ;P;Z]$ if, for any $p,q\in L$, there exists a path of non-zero length from p to q in ${\mathbb{G}}_{\phi [P;Z]}$ such that all vertices in the path belong to

$$L\cup Z\cup \neg Z.$$

Given a directed graph $G=(V,E)$, the collapsed dependency graph ${\mathbb{S}}_G=(\mathbb{V},\mathbb{E})$ of G is the directed acyclic graph (DAG) defined as follows:

• $\mathbb{V}$ is the set of strongly connected components (SCCs) of G. That is, every $C\in \mathbb{V}$ is a maximal subgraph $G^{\prime }=(V^{\prime },E^{\prime })$ of G such that $G^{\prime }$ has a path from any vertex $v^{\prime }\in V^{\prime }$ to every other vertex in $V^{\prime }$. When no confusion arises, we also denote such a component $G^{\prime }$ by its vertex set $V^{\prime }$.
• $\mathbb{E}$ consists of all edges $(C,C^{\prime })$ such that $C,C^{\prime }\in \mathbb{V}$, $C\ne C^{\prime }$, and there exist vertices $u\in C$ and $v\in C^{\prime }$ with $(u,v)\in E$.

For a clause theory $\phi$ and two disjoint sets of atoms $P,Z$, we write

$${\mathbb{S}}_{\phi [P;Z]}$$

instead of ${\mathbb{S}}_{{\mathbb{G}}_{\phi [P;Z]}}$. When a strongly connected component C is used as a vertex of a collapsed dependency graph, $\mathrm{lab}\left(C\right)$ denotes the set of original graph vertices represented by C.

A source S of ${\mathbb{S}}_{\phi [P;Z]}$ is called empty if $S\cap P=\varnothing$. For a component S of ${\mathbb{S}}_{\phi [P;Z]}$, let ${\phi }_S$ denote the set of clauses $\alpha \in \phi$ such that every vertex of ${\mathbb{G}}_{\phi [P;Z]}$ whose underlying atom occurs in $\alpha$ belongs to S. Here the polarity of the occurrence in $\alpha$ is ignored: if an atom p appears in $\alpha$ either as p or as $\neg p$, then the graph vertices whose underlying atom is p are treated as occurring in $\alpha$.

Example 5. 

Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

Take $M=\{p_1,p_2,p_3\}$. Then $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M]=\phi ,R=M\cap P=P.$$

Thus ${\mathbb{G}}_{\psi [R;Z]}$ has vertex set

$$V=\{p_1,p_2,p_3,z_1,\neg z_1\}.$$

The clauses ${\alpha }_1$ and ${\alpha }_2$ induce the edges $p_1\to p_2$ and $p_2\to p_1$, respectively. The clause ${\alpha }_3$ induces the edge $p_3\to p_1$. The clause ${\alpha }_4$ contains $z_1$, and hence induces edges from $\neg z_1$ to the literals occurring with $z_1$, in particular $\neg z_1\to p_3$.

The solid part of Figure 1 shows the negative dependency graph ${\mathbb{G}}_{\psi [R;Z]}$. The dashed boxes denote the vertices of the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$, obtained by contracting strongly connected components.

For a component C of a collapsed dependency graph $\mathbb{S}$, let ${\mathrm{Anc}}_{\mathbb{S}}\left(C\right)$ be the set of its ancestor components. First form the raw ancestor set

$$A_{\mathbb{S}}\left(C\right)=\bigcup _{D\in {Anc}_{\mathbb{S}}\left(C\right)\cup \left\{C\right\}}\mathrm{lab}\left(D\right).$$

The scope used in local obligations is the atom-completed ancestor scope

$${Scope}_{\mathbb{S}}\left(C\right)=A_{\mathbb{S}}\left(C\right)\cup \{z,\neg z\mid z\in Z,\{z,\neg z\}\cap A_{\mathbb{S}}\left(C\right)\ne \varnothing \}.$$

Thus, whenever one signed vertex of a varied atom is needed in a scope, the other signed vertex is included as well. The set ${Scope}_{\mathbb{S}}\left(C\right)$ is a set of graph vertices, not a tuple and not necessarily a set of atoms. To speak about a local obligation for a component, we also need to restrict the reduct to the clauses whose graph vertices lie within a chosen scope.

Definition 6 

(Induced subtheory). Let φ be a clause theory, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

and ${\mathbb{G}}_{\psi [R;Z]}=(V,E)$. Let $U\subseteq V$. The induced subtheory of ψ on U is

$${\psi }_U=\{\alpha \in \psi \mid \mathit{every}\mathit{vertex}\mathit{of}{\mathbb{G}}_{\psi [R;Z]}\mathit{whose}\mathit{underlying}\mathit{atom}\mathit{occurs}\mathit{in}\mathit{\alpha }\mathit{belongs}\mathit{to}U\}.$$

In this definition, occurrence is tested at the atom level rather than at the signed-literal level. Thus, if an atom p occurs in α either as p or as $\neg p$, then the graph vertices whose underlying atom is p are all relevant to the membership test for ${\psi }_U$.

Example 6 

(Cont. Example 5). Let $\psi =\phi$ and $R=P$. The clauses ${\alpha }_1$ and ${\alpha }_2$ involve only the atoms $p_1$ and $p_2$, while ${\alpha }_3$ involves $p_1$ and $p_3$. The clause ${\alpha }_4$ involves the atoms $p_3$ and $z_1$. Since $z_1$ is varied, both graph vertices $z_1$ and $\neg z_1$ are relevant whenever the atom $z_1$ occurs, regardless of the polarity of its occurrence in the clause. Consequently, if

$$U=\{p_1,p_2,p_3\},$$

then

$${\psi }_U=\{{\alpha }_1,{\alpha }_2,{\alpha }_3\},$$

because ${\alpha }_4$ also depends on the varied-atom vertices $z_1$ and $\neg z_1$. If

$$U^{\prime }=\{p_3,z_1,\neg z_1\},$$

then ${\psi }_{U^{\prime }}=\left\{{\alpha }_4\right\}$.

4. Decomposition of Reduct Entailment

By Theorem 1, model checking for M is equivalent to the residual entailment $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge (M\cap P)$. We decompose this entailment by the collapsed dependency graph of the reduct. The decomposition is candidate-dependent, since the graph is computed after the minimal reduct has been formed [17,25,26].

The argument is developed in three stages. First, the collapsed graph induces an ordered partition of the minimized atoms occurring in the candidate. Second, a constructive countermodel-extension lemma identifies when the entailment for one graph component can be checked on its ancestor scope. Third, two reduct-transfer propositions justify contracting a verified block and continuing with the remaining blocks. This separation keeps the graph argument and the contraction argument logically distinct.

Throughout this section, put

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P.$$

A dependency partition of R must respect the topological order of ${\mathbb{S}}_{\psi [R;Z]}$; this is the condition under which verified blocks may be contracted without changing the residual test for later blocks.

Definition 7 

(Dependency partition). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

and ${\mathbb{S}}_{\psi [R;Z]}=(\mathbb{V},\mathbb{E})$ be the collapsed dependency graph. Choose any topological ordering $C_1,\dots ,C_t$ of the components in $\mathbb{V}$. Remove all empty intersections $\mathrm{lab}\left(C_j\right)\cap R$, and write the remaining non-empty sets, in the induced order, as

$$L_1,\dots ,L_n.$$

The sequence $L_1,\dots ,L_n$ is called a dependency partition of R with Z for the reduct ψ. Each block $L_i$ is the intersection of R with one strongly connected component of ${\mathbb{G}}_{\psi [R;Z]}$, and the order of the blocks respects the topological order of ${\mathbb{S}}_{\psi [R;Z]}$.

The partition is determined by dependency, not by an arbitrary grouping of R. Atoms in the same block are mutually dependent in the negative dependency graph, while the order between blocks is inherited from the condensation DAG. The prefix preceding a block therefore consists exactly of the minimized atoms whose dependency position permits them to be contracted before that block is considered.

For $i\ge 1$, let

$$X_i=L_1\cup \cdots \cup L_{i-1},X_1=\varnothing .$$

The set $X_i$ contains the target atoms verified before the block $L_i$. For each component, the checker must justify only the minimized atoms that occur in that component. The next definition names this target and the corresponding local entailment condition.

Definition 8 

(Local verification obligation). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

and $\mathbb{S}={\mathbb{S}}_{\psi [R;Z]}$. Let C be a vertex of the collapsed dependency graph $\mathbb{S}$. Define

$${\Delta }_C=\mathrm{lab}\left(C\right)\cap R.$$

If ${\Delta }_C\ne \varnothing$, the local verification obligation associated with C is

$${\psi }_{{Scope}_{\mathbb{S}}\left(C\right)}\vDash \bigwedge {\Delta }_C.$$

(7)

If ${\Delta }_C=\varnothing$, then C carries no local verification obligation.

For component selection, the algorithm works on a copy of the collapsed DAG. It repeatedly deletes current source components whose labels are disjoint from the current verification target, and then selects a source component whose label intersects that target. The scope of the selected component is computed in the original collapsed graph.

The decomposition results below use several closely related objects derived from the current reduct. To make their roles explicit before the main locality lemma and decomposition theorems,

Table 1. Notation used in the decomposition results of Section 4.

Symbol	Meaning
$\psi$	minimal reduct $\mathrm{Red}[\phi ;P;Z,M]$ associated with the candidate M
R	minimized atoms true in the candidate, $M\cap P$
$\mathbb{S}$	collapsed negative dependency graph ${\mathbb{S}}_{\psi [R;Z]}$
C	a strongly connected component represented as a vertex of $\mathbb{S}$
$A_{\mathbb{S}}\left(C\right)$	union of the labels of C and its ancestor components
${\mathrm{Scope}}_{\mathbb{S}}\left(C\right)$	atom-completed ancestor scope of C
${\Delta }_C$	local minimized-atom target $\mathrm{lab}\left(C\right)\cap R$
$L_i$	the i-th block of a dependency partition of R
$X_i$	previously verified prefix $L_1\cup \cdots \cup L_{i-1}$
${\psi }_U$	subtheory of $\psi$ induced by the vertex set U

summarizes the notation used throughout this section. Every entry has already been defined above or in Section 3; the table introduces no additional mathematical objects.

Lemma 1 

(Lifting a scoped countermodel). Let φ be a clause theory over $\mathcal{A}$, let $R,Z\subseteq \mathcal{A}$ be disjoint sets of atoms, and let $M\vDash \phi$ with $R\subseteq M$. Put

$$\psi =\mathrm{Red}[\phi ;R;Z,M],\mathbb{S}={\mathbb{S}}_{\psi [R;Z]}.$$

For a component C of $\mathbb{S}$, let

$$A=A_{\mathbb{S}}\left(C\right),U={Scope}_{\mathbb{S}}\left(C\right),\Delta =\mathrm{lab}\left(C\right)\cap R,$$

and let $\mathrm{At}\left(U\right)$ be the set of underlying atoms represented in U. If

$${\psi }_U/\vDash \bigwedge \Delta ,$$

then there exist an atom $p\in \Delta$ and an interpretation I such that

$$I\vDash {\psi }_U,p\notin I,$$

and the interpretation

$$J=\left(I\cap \mathrm{At}\left(U\right)\right)\cup \left(M\backslash \mathrm{At}\left(U\right)\right)$$

(8)

satisfies ψ. In particular, $p\notin J$.

Proof. 

Choose $p\in \Delta$ for which ${\psi }_U/\vDash p$. Among the models I of ${\psi }_U$ with $p\notin I$, choose one minimizing, under set inclusion, the set

$$K\left(I\right)=\{l\in U\backslash A\mid M\vDash l\mathrm{and}I/\vDash l\}.$$

Every vertex in $U\backslash A$ is the completion-added signed vertex of a varied atom; its complementary signed vertex belongs to A.

We first show that $K\left(I\right)=\varnothing$. Suppose otherwise, and let $I^{\prime }$ be obtained from I by restoring, to their values in M, all varied atoms whose M-true signed vertices belong to $K\left(I\right)$. The atom p is unchanged. Assume that some clause $\alpha \in {\psi }_U$ is falsified by $I^{\prime }$. Since $I\vDash \alpha$, the clause $\alpha$ contains a literal $\neg l$, for some $l\in K\left(I\right)$, that is true under I and false under $I^{\prime }$. On the other hand, $M\vDash \alpha$; hence $\alpha$ contains a literal $l^{\prime }$ that is true under M. The literal $l^{\prime }$ is false under $I^{\prime }$. Its atom was therefore not restored, and the corresponding signed vertex does not belong to $K\left(I\right)$. Since $\alpha \in {\psi }_U$, this vertex belongs to U. It cannot lie in $U\backslash A$, because then it would belong to $K\left(I\right)$. Thus $l^{\prime }\in A$.

The clause $\alpha$ contains both $\neg l$ and $l^{\prime }$. By Definition 5, the graph contains the edge $l\to l^{\prime }$. Since $l^{\prime }\in A$, the component containing l is an ancestor of C, and hence $l\in A$, contradicting $l\in U\backslash A$. Therefore $I^{\prime }\vDash {\psi }_U$. Moreover, $p\notin I^{\prime }$ and $K\left(I^{\prime }\right)⊊K\left(I\right)$, contradicting the choice of I. Hence $K\left(I\right)=\varnothing$.

Define J by (8). Suppose that $J/\vDash \gamma$ for some $\gamma \in \psi$. The interpretation M satisfies every clause of $\psi$: for each retained reduct clause, the side conditions in Definition 4 ensure that every deleted literal is false under M. Thus $\gamma$ contains a literal $l^{\prime }$ such that $M\vDash l^{\prime }$. Since J agrees with M outside $\mathrm{At}\left(U\right)$, the underlying atom of $l^{\prime }$ belongs to $\mathrm{At}\left(U\right)$. The corresponding signed vertex is false under I. Because $K\left(I\right)=\varnothing$, this vertex belongs to A.

The clause $\gamma$ cannot belong to ${\psi }_U$, because $I\vDash {\psi }_U$ and I and J agree on $\mathrm{At}\left(U\right)$. Hence $\gamma$ contains a literal $\neg l$ whose underlying atom lies outside $\mathrm{At}\left(U\right)$. Since $J/\vDash \gamma$ and J agrees with M outside $\mathrm{At}\left(U\right)$, we have $M\vDash l$. The signed vertex l lies outside U. However, $\{\neg l,l^{\prime }\}\subseteq \gamma$, so Definition 5 yields the edge $l\to l^{\prime }$. As $l^{\prime }\in A$, this makes l an ancestor of C, contradicting $l\notin U$. Therefore $J\vDash \psi$. Finally, $p\in \Delta \subseteq \mathrm{At}\left(U\right)$, so $p\notin J$.    □

The construction in Lemma 1 is the nontrivial direction of locality. It shows that a failure of the scoped obligation is a genuine failure of the full residual entailment, with the falsified minimized atom preserved. The converse direction requires only the set inclusion ${\psi }_U\subseteq \psi$, and the two directions are summarized in the following corollary.

Corollary 1 

(Scoped entailment). Under the assumptions of Lemma 1,

$$\psi \vDash \bigwedge \Delta ⟺{\psi }_U\vDash \bigwedge \Delta .$$

(9)

Proof. 

The implication from right to left follows from ${\psi }_U\subseteq \psi$. For the converse, assume ${\psi }_U/\vDash \bigwedge \Delta$. By Lemma 1, there exists a model J of $\psi$ that falsifies an atom of $\Delta$. Hence $\psi /\vDash \bigwedge \Delta$.    □

Example 7 

(Cont. Example 5). Let

$$\psi =\mathrm{Red}[\phi ;P;Z,M]=\phi ,R=M\cap P=P.$$

In the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$, let $C_{\neg z_1}$, $C_{z_1}$, $C_3$, and $C_{12}$ be the vertices satisfying

$$\mathrm{lab}\left(C_{\neg z_1}\right)=\{\neg z_1\},\mathrm{lab}\left(C_{z_1}\right)=\left\{z_1\right\},\mathrm{lab}\left(C_3\right)=\left\{p_3\right\},\mathrm{lab}\left(C_{12}\right)=\{p_1,p_2\}.$$

The component $C_{12}$ corresponds to the strongly connected component formed by $p_1$ and $p_2$, while $C_3$ is the singleton component containing $p_3$. The edge $p_3\to p_1$ in ${\mathbb{G}}_{\psi [R;Z]}$ induces an edge $C_3\to C_{12}$ in ${\mathbb{S}}_{\psi [R;Z]}$. The edge $\neg z_1\to p_3$ induces an edge $C_{\neg z_1}\to C_3$.

Hence the non-empty minimized components, ordered according to the collapsed dependency graph, give the dependency partition

$$L_1=\mathrm{lab}\left(C_3\right)\cap R=\left\{p_3\right\},L_2=\mathrm{lab}\left(C_{12}\right)\cap R=\{p_1,p_2\}.$$

For the first component $C_3$, the local target is

$${\Delta }_{C_3}=\mathrm{lab}\left(C_3\right)\cap R=\left\{p_3\right\}.$$

The scope of $C_3$ contains the vertices needed to express the clauses relevant to $C_3$. In this example,

$${Scope}_{\mathbb{S}}\left(C_3\right)=\{p_3,z_1,\neg z_1\}.$$

Therefore the induced local theory is

$${\psi }_{{Scope}_{\mathbb{S}}\left(C_3\right)}=\{{\alpha }_4:p_3\vee z_1\}.$$

The corresponding local verification obligation is

$${\psi }_{{Scope}_{\mathbb{S}}\left(C_3\right)}\vDash \bigwedge {\Delta }_{C_3},$$

that is,

$$\{p_3\vee z_1\}\vDash p_3.$$

The interpretation $\left\{z_1\right\}$ satisfies $p_3\vee z_1$ and falsifies $p_3$, so the obligation fails. The graph determines the component, and the local verification consists of the entailment over its induced subtheory.

The next two propositions establish model transfer between an uncontracted reduct and the reduct obtained after removing the verified blocks from the set of minimized atoms.

Proposition 4. 

Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

and $L_1,\dots ,L_n$ be a dependency partition of R with Z for ψ. For $1\le i\le n$, let

$$X_i=L_1\cup \cdots \cup L_{i-1},X_1=\varnothing .$$

If $N\vDash \mathrm{Red}[\phi ;P\backslash X_i;Z,M]$, then $N\cup X_i\vDash \mathrm{Red}[\phi ;P;Z,M]$.

Proof. 

Let $\beta \in \mathrm{Red}[\phi ;P;Z,M]$, and $\alpha \in \phi$ be a clause from which $\beta$ is derived. Put

$${\beta }_i=\left({\alpha }^{+}\cap (((P\backslash X_i)\cap M)\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap (((P\backslash X_i)\cap M)\cup Z)\right)$$

when this clause is not omitted in $\mathrm{Red}[\phi ;P\backslash X_i;Z,M]$. Since $X_i\subseteq R=M\cap P$, moving from P to $P\backslash X_i$ treats the atoms of $X_i$ as fixed true atoms.

If ${\beta }_i$ belongs to $\mathrm{Red}[\phi ;P\backslash X_i;Z,M]$, then $N\vDash {\beta }_i$. The clause $\beta$ is obtained from ${\beta }_i$ by possibly adding literals whose atoms are in $X_i$. Hence $N\cup X_i\vDash \beta$ unless all satisfying literals of $\beta$ were removed by the contraction. This cannot happen: any positive atom from $X_i$ is true in $N\cup X_i$, while any negative literal over $X_i$ is false and therefore irrelevant to satisfaction. Thus $N\cup X_i\vDash \beta$.

If ${\beta }_i\notin \mathrm{Red}[\phi ;P\backslash X_i;Z,M]$, then some side condition for $\mathrm{Red}[\phi ;P\backslash X_i;Z,M]$ fails. Since $\beta$ is present in $\mathrm{Red}[\phi ;P;Z,M]$, conditions involving fixed atoms outside $P\cup Z$ cannot be responsible for the failure. Nor can condition (i) fail because all atoms of $X_i$ are true in M. The only possible new failure is condition (ii), caused by a positive occurrence of an atom in $X_i$. Such an atom occurs positively in $\beta$ and is true in $N\cup X_i$. Hence $N\cup X_i\vDash \beta$ in this case as well. Since $\beta$ was arbitrary, $N\cup X_i\vDash \mathrm{Red}[\phi ;P;Z,M]$.    □

The converse transfer holds for models containing the previously verified atoms.

Proposition 5. 

Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ with disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

and $L_1,\dots ,L_n$ be a dependency partition of R with Z for ψ. For some $i\in \{1,\dots ,n\}$, let

$$X_i=L_1\cup \cdots \cup L_{i-1},X_1=\varnothing .$$

If $N\vDash \mathrm{Red}[\phi ;P;Z,M]$ and $X_i\subseteq N$, then $N\vDash \mathrm{Red}[\phi ;P\backslash X_i;Z,M]$.

Proof. 

Let ${\beta }_i\in \mathrm{Red}[\phi ;P\backslash X_i;Z,M]$, and $\alpha \in \phi$ be the original clause from which it is derived. We compare ${\beta }_i$ with the clause $\beta$ obtained from $\alpha$ in $\mathrm{Red}[\phi ;P;Z,M]$.

First, $\beta$ cannot be omitted. If condition (i) failed for the set P of minimized atoms, then it would also fail for $P\backslash X_i$, except possibly through an atom of $X_i$; but $X_i\subseteq M$, so no such atom is in $\overline{M}$. If condition (ii) or (iii) failed because of a fixed atom outside $P\cup Z$, the same failure would occur for $P\backslash X_i$. If condition (ii) failed because of a positive atom in $X_i$, then ${\beta }_i$ would be omitted by the contracted reduct, contrary to the choice of ${\beta }_i$. Thus $\beta \in \mathrm{Red}[\phi ;P;Z,M]$.

Since $N\vDash \mathrm{Red}[\phi ;P;Z,M]$, we have $N\vDash \beta$. The only literals present in $\beta$ but absent from ${\beta }_i$ have atoms in $X_i$. Positive literals over $X_i$ cannot occur, because ${\beta }_i$ would then have been omitted by condition (ii) for the contracted reduct. Negative literals over $X_i$, if present in $\beta$, are false in N because $X_i\subseteq N$. Therefore $N\vDash \beta$ must be witnessed by a literal already present in ${\beta }_i$. Hence $N\vDash {\beta }_i$. Since ${\beta }_i$ was arbitrary, $N\vDash \mathrm{Red}[\phi ;P\backslash X_i;Z,M]$.    □

Propositions 4 and 5 yield the layer decomposition.

The blocks in the following theorem are not an arbitrary set partition. By Definition 7, they are obtained by intersecting R with the SCCs of the negative dependency graph and retaining the order induced by a topological ordering of the collapsed graph. Thus the partition appearing in the statement is graph-derived. Once this ordered partition is fixed, the semantic equivalence below follows from the two model-transfer propositions. The additional graph-theoretic argument required for locality is given afterwards, when a full residual entailment is replaced by an entailment over the ancestor scope of a selected source component.

Theorem 2 

(Decomposition of reduct entailment). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ withs disjoint atom sets, $M\vDash \phi$,

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

and $L_1,\dots ,L_n$ be a dependency partition of R with Z for ψ. For $1\le i\le n$, let

$$X_i=L_1\cup \cdots \cup L_{i-1},X_1=\varnothing .$$

Then

$$M\vDash \mathrm{CIRC}[\phi ;P;Z]$$

if and only if, for every $i\in \{1,\dots ,n\}$,

$$\mathrm{Red}[\phi ;P\backslash X_i;Z,M]\vDash \bigwedge L_i.$$

(10)

Proof. 

By Theorem 1, it is enough to prove that $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge R$ is equivalent to the family of obligations (10). By Definition 7,

$$R=L_1\dot{\cup }\cdots \dot{\cup }{L}_n,$$

and the order of these blocks is inherited from the collapsed dependency graph. The proof below uses this ordered partition together with the extension and restriction properties of the reduct.

Assume first that $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge R$. Suppose, for a contradiction, that (10) fails for some i. Then there exists an interpretation N such that

$$N\vDash \mathrm{Red}[\phi ;P\backslash X_i;Z,M]\mathrm{and}N/\vDash \bigwedge L_i.$$

By Proposition 4, $N\cup X_i\vDash \mathrm{Red}[\phi ;P;Z,M]$. Since $L_i\cap X_i=\varnothing$, the interpretation $N\cup X_i$ still falsifies some atom of $L_i$. This contradicts $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge R$, because $L_i\subseteq R$.

Conversely, assume that all obligations (10) hold. Let $N\vDash \mathrm{Red}[\phi ;P;Z,M]$. We prove by induction on i that

$$L_1\cup \cdots \cup L_i\subseteq N.$$

For $i=1$, we have $X_1=\varnothing$, so the first obligation says $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge L_1$, and hence $L_1\subseteq N$. For the induction step, assume $X_i=L_1\cup \cdots \cup L_{i-1}\subseteq N$. By Proposition 5,

$$N\vDash \mathrm{Red}[\phi ;P\backslash X_i;Z,M].$$

The i-th obligation then gives $L_i\subseteq N$. Thus $X_{i+1}\subseteq N$. By induction, $R=L_1\cup \cdots \cup L_n\subseteq N$. Since N was an arbitrary model of the original reduct, $\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge R$, as required.    □

Theorem 2 treats all blocks of a dependency partition simultaneously. For the algorithm, the relevant statement is the corresponding one-step decomposition. Given the atoms already verified, the next result identifies a source block with a non-empty target intersection, replaces its full residual entailment by the scoped obligation, and separates the remaining target into the next reduct.

Theorem 3 

(Source-component decomposition). Let φ be a clause theory over $\mathcal{A}$, let $P,Z\subseteq \mathcal{A}$ be disjoint sets of atoms, and let $M\vDash \phi$. Let

$$X\subseteq M\cap P,R=(M\cap P)\backslash X,$$

and put

$$\psi =\mathrm{Red}[\phi ;P\backslash X;Z,M].$$

Assume that $R\ne \varnothing$, and let

$$\mathbb{S}={\mathbb{S}}_{\psi [R;Z]}.$$

Starting from a working copy of $\mathbb{S}$, at each round delete all current source components D satisfying $\mathrm{lab}\left(D\right)\cap R=\varnothing$. Let C be a source component of the resulting graph such that

$$\Delta =\mathrm{lab}\left(C\right)\cap R\ne \varnothing .$$

Define

$$U={Scope}_{\mathbb{S}}\left(C\right),{\psi }^{\prime }=\mathrm{Red}[\phi ;P\backslash (X\cup \Delta );Z,M].$$

Then

$$\psi \vDash \bigwedge R⟺\left({\psi }_U\vDash \bigwedge \Delta \mathit{and}{\psi }^{\prime }\vDash \bigwedge (R\backslash \Delta )\right).$$

(11)

Proof. 

We first verify that the selection of C is well defined. The collapsed component graph $\mathbb{S}$ is a finite DAG, and every deleted source component has label disjoint from R. Hence no component containing an atom of R is removed. Since $R\ne \varnothing$, a target-bearing component remains. Repeated deletion must therefore expose a source component C satisfying $\Delta =\mathrm{lab}\left(C\right)\cap R\ne \varnothing$.

Let $Q=P\backslash X$. Since $X\subseteq M\cap P$,

$$R=(M\cap P)\backslash X=Q\cap M.$$

By Definition 4, atoms of $Q\backslash M$ produce the same reduction whether they are treated as minimized atoms false in M or as fixed atoms false in M. Consequently,

$$\psi =\mathrm{Red}[\phi ;Q;Z,M]=\mathrm{Red}[\phi ;R;Z,M].$$

(12)

Thus Corollary 1 applies to the current residual theory.

Every deleted component was a source at the stage at which it was removed. Hence the deleted components can be placed before C in a topological ordering of $\mathbb{S}$. After blocks with empty intersection with R are omitted, Definition 7 yields a dependency partition whose first block is $\Delta$. Thus the two model-transfer propositions apply to the theory $\phi$, with minimized set $P\backslash X$ and first contracted block $\Delta$.

Assume first that $\psi \vDash \bigwedge R$. Corollary 1 gives

$${\psi }_U\vDash \bigwedge \Delta .$$

Let $N\vDash {\psi }^{\prime }$. Proposition 4, applied to the first block $\Delta$, yields

$$N\cup \Delta \vDash \psi .$$

Therefore $R\subseteq N\cup \Delta$. Since $(R\backslash \Delta )\cap \Delta =\varnothing$, it follows that $R\backslash \Delta \subseteq N$. Hence

$${\psi }^{\prime }\vDash \bigwedge (R\backslash \Delta ).$$

Conversely, assume that

$${\psi }_U\vDash \bigwedge \Delta \mathrm{and}{\psi }^{\prime }\vDash \bigwedge (R\backslash \Delta ).$$

Let $N\vDash \psi$. By Corollary 1, $\psi \vDash \bigwedge \Delta$, and therefore $\Delta \subseteq N$. Proposition 5 then gives $N\vDash {\psi }^{\prime }$. The second entailment implies $R\backslash \Delta \subseteq N$, whence $R\subseteq N$. Since N was arbitrary, $\psi \vDash \bigwedge R$. This proves (11).    □

Example 8 

(Source-component checking). Let

$$P=\{p_1,p_2,p_3\},Z=\{z_1,z_2\},$$

and

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1,{\alpha }_5:q_1\vee \neg z_1,{\alpha }_6:p_2\vee p_3\vee z_2\}.$$

Consider

$$M_1=\{p_1,p_2,p_3\}.$$

Then $M_1\vDash \phi$. The minimal reduct of φ with respect to $M_1$ is

$$\psi =\mathrm{Red}[\phi ;P;Z,M_1]=\{{\alpha }_1,{\alpha }_2,{\alpha }_3,{\alpha }_4,{\alpha }_5^{\prime }:\neg z_1,{\alpha }_6\}.$$

Since

$$R=M_1\cap P=P,$$

the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$ contains two non-empty minimized components. Let $C_3$ and $C_{12}$ be the corresponding vertices of ${\mathbb{S}}_{\psi [R;Z]}$, with

$$\mathrm{lab}\left(C_3\right)=\left\{p_3\right\},\mathrm{lab}\left(C_{12}\right)=\{p_1,p_2\}.$$

Thus a source-component order gives the dependency partition

$$L_1=\mathrm{lab}\left(C_3\right)\cap R=\left\{p_3\right\},L_2=\mathrm{lab}\left(C_{12}\right)\cap R=\{p_1,p_2\}.$$

A corresponding negative dependency graph is shown in Figure 2.

For the first component $C_3$, the local target is

$${\Delta }_{C_3}=\mathrm{lab}\left(C_3\right)\cap R=\left\{p_3\right\}.$$

Its scope in the collapsed dependency graph is

$${Scope}_{{\mathbb{S}}_{\psi [R;Z]}}\left(C_3\right)=\{p_3,z_1,\neg z_1,z_2,\neg z_2\}.$$

Indeed, ${\alpha }_6=p_2\vee p_3\vee z_2$ induces the edge $\neg z_2\to p_3$, so both signed vertices of the varied atom $z_2$ enter the atom-completed ancestor scope. Nevertheless, ${\alpha }_6$ is not a clause of the induced subtheory because it also contains the atom $p_2$, which lies outside this scope. Hence the induced local theory is

$${\psi }_{{Scope}_{{\mathbb{S}}_{\psi [R;Z]}}\left(C_3\right)}=\{{\alpha }_4:p_3\vee z_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

The first local verification obligation is therefore

$${\psi }_{{Scope}_{{\mathbb{S}}_{\psi [R;Z]}}\left(C_3\right)}\vDash \bigwedge {\Delta }_{C_3},$$

that is,

$$\{p_3\vee z_1,\neg z_1\}\vDash p_3.$$

After this local obligation is certified, the verified atom $p_3$ is contracted. The next residual reduct is

$$\mathrm{Red}[\phi ;P\backslash \left\{p_3\right\};Z,M_1]=\{{\alpha }_1,{\alpha }_2,{\alpha }_3^{\prime }:p_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

This residual reduct entails

$$p_1\wedge p_2.$$

Thus the global entailment

$$\mathrm{Red}[\phi ;P;Z,M_1]\vDash p_1\wedge p_2\wedge p_3$$

is checked in two source-component steps:

$$\left\{p_3\right\}\mathit{first},\mathit{then}\{p_1,p_2\}.$$

Thus the source-component form verifies the global reduct entailment through successive local obligations and residual-reduct recomputation.

Section 5 augments these obligations with origin-preserving supports and scoped countermodels.

5. Checking Algorithm and Origin-Based Local Certification

The checker repeatedly applies the one-step equivalence of Theorem 3. At each successful step, it certifies the current scoped obligation, contracts the corresponding block, and recomputes the residual reduct. The procedure LocalCertify returns an origin-preserving support or a scoped countermodel.

A certificate fragment is recorded over the original theory. For a local residual theory $\lambda$, the returned support is a set $\kappa \subseteq \phi$ such that replaying $\kappa$ through the current reduct and scope yields an unsatisfiable target-negation test. Hence $\kappa$ is a primitive-clause support for the local entailment.

5.1. Origin-Preserving Certificates and Failure Packages

During the iterative checking process, every residual clause is represented by at least one clause of the original theory. The certificate records one such representative because the checker constructs one sufficient certificate and does not enumerate all possible supports.

Let $C_i$ be the source component selected at iteration i, and let

$${\Delta }_i=\mathrm{lab}\left(C_i\right)\cap R_i.$$

The certificate stores ${\Delta }_i$, rather than an SCC identifier. During replay, the verifier reconstructs ${\psi }_i$, $R_i$, and the collapsed graph. Since ${\Delta }_i\ne \varnothing$ and strongly connected components partition the graph vertices, any atom of ${\Delta }_i$ identifies a unique current component. The verifier then checks that its intersection with $R_i$ is exactly ${\Delta }_i$, and that it is selectable after the repeated removal of source components disjoint from $R_i$. Thus the encoding is independent of transient SCC numbers and of any ordering on atom names.

The component field and the clause field serve different purposes. The block ${\Delta }_i$ reconstructs the graph position of the local obligation, whereas the origin map reconstructs a sufficient set of original clauses. Since the checker seeks one replayable support, one representative origin for each residual clause is sufficient.

For every residual theory ${\psi }_i$, let

$${\mathrm{Orig}}_i:{\psi }_i⟶\phi$$

be a representative origin map. For a set $\mathsf{\Lambda }\subseteq {\psi }_i$, write

$${\mathrm{Orig}}_i\left(\mathsf{\Lambda }\right)=\{{\mathrm{Orig}}_i\left(\gamma \right)\mid \gamma \in \mathsf{\Lambda }\}.$$

Initially, for every $\gamma \in {\psi }_0$, choose an arbitrary original clause $\alpha \in \phi$ whose reduction is $\gamma$, and set ${\mathrm{Orig}}_0\left(\gamma \right)=\alpha$. Let ${\rho }_i\left(\gamma \right)$ denote the clause-level result of applying the next reduct step to $\gamma$. For every ${\gamma }^{\prime }\in {\psi }_{i+1}$, choose an arbitrary clause $\gamma \in {\psi }_i$ such that ${\rho }_i\left(\gamma \right)={\gamma }^{\prime }$, and define

$${\mathrm{Orig}}_{i+1}\left({\gamma }^{\prime }\right)={\mathrm{Orig}}_i\left(\gamma \right).$$

If several residual clauses produce the same clause ${\gamma }^{\prime }$, one predecessor is selected as its representative. If a clause reduces to ⊤, it is omitted and produces no entry in ${\mathrm{Orig}}_{i+1}$. The representative choice may be made deterministic, for example by selecting the first predecessor in the fixed input-clause order.

This representative choice is sufficient because the checker seeks one original-clause support for each local entailment. It does not enumerate all supports or all provenance alternatives. For every selected residual clause, reducing its representative origin at the same stage reproduces that residual clause; consequently, replay soundness is independent of which representative was chosen.

Proposition 3, together with the same clause-wise observation used in (12), gives

$${\psi }_i\equiv \mathrm{Red}[\phi ;R_i;Z,M],$$

where duplicate clauses are ignored. Hence each residual theory has the form required by Corollary 1.

Definition 9  

(Origin-preserving decomposition certificate). Let φ be a clause theory over $\mathcal{A}$, let $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, and let $M\vDash \phi$. Put

$${\psi }_0=\mathrm{Red}[\phi ;P;Z,M],R_0=M\cap P.$$

An origin-preserving decomposition certificate for M with respect to $\mathrm{CIRC}[\phi ;P;Z]$ is a finite sequence

$$\mathcal{C}=\langle {\chi }_0,\dots ,{\chi }_{m-1}\rangle ,{\chi }_i=({\Delta }_i,{\kappa }_i),$$

where every ${\Delta }_i$ is a finite non-empty set of atoms and every ${\kappa }_i$ is a set of clauses of φ. The sequence is valid if there exist residual theories ${\psi }_0,\dots ,{\psi }_m$, verification targets $R_0,\dots ,R_m$, and representative origin maps ${\mathrm{Orig}}_i$ satisfying the following conditions for every $0\le i<m$.

Let

$${\mathbb{S}}_i={\mathbb{S}}_{{\psi }_i[R_i;Z]}.$$

The non-empty set ${\Delta }_i$ identifies a component $C_i$ of ${\mathbb{S}}_i$ through

$${\Delta }_i=\mathrm{lab}\left(C_i\right)\cap R_i.$$

Starting from a working copy of ${\mathbb{S}}_i$, at each round delete all current source components whose labels are disjoint from $R_i$; validity requires that $C_i$ be a source of the resulting graph. Define

$$U_i={Scope}_{{\mathbb{S}}_i}\left(C_i\right),{\lambda }_i={\left({\psi }_i\right)}_{U_i},{\beta }_i=\bigvee \neg {\Delta }_i.$$

The support field satisfies

$${\kappa }_i\subseteq {\mathrm{Orig}}_i\left({\lambda }_i\right)\mathit{and}{\left(\mathrm{Red}[{\kappa }_i;R_i;Z,M]\right)}_{U_i}\cup \left\{{\beta }_i\right\}\vDash \perp .$$

Finally,

$$R_{i+1}=R_i\backslash {\Delta }_i,{\psi }_{i+1}=\mathrm{Red}[{\psi }_i;R_{i+1};Z,M],$$

the representative origin map is updated by the predecessor rule above, and

$$R_m=\varnothing .$$

The certificate therefore stores neither SCC identifiers nor scopes. The prefix ${\Delta }_0,\dots ,{\Delta }_{i-1}$ reconstructs the residual state at stage i; the current non-empty set ${\Delta }_i$ identifies $C_i$; and $U_i$ and ${\lambda }_i$ are derived from the recomputed graph and theory. The validity test also checks that the reconstructed component is eligible for source selection at that stage.

A successful fragment establishes an entailment by an unsatisfiable support. When the local test is satisfiable, a counterexample is given by a model of the scoped theory together with the negation of the local target. The following definition specifies the data required to replay such a failure.

Definition 10  

(Failure package). Suppose the checker has successfully produced the prefix

$${\mathcal{C}}_{<i}=\langle ({\Delta }_0,{\kappa }_0),\dots ,({\Delta }_{i-1},{\kappa }_{i-1})\rangle$$

and has thereby reconstructed the current state $({\psi }_i,R_i,{\mathrm{Orig}}_i)$. Let ${\mathbb{S}}_i={\mathbb{S}}_{{\psi }_i[R_i;Z]}$. A failure package at stage i is a triple

$$\mathcal{F}=({\mathcal{C}}_{<i},{\Delta }_i,I_i),$$

where ${\Delta }_i\ne \varnothing$ identifies the current component $C_i$ by ${\Delta }_i=\mathrm{lab}\left(C_i\right)\cap R_i$. Starting from a working copy of ${\mathbb{S}}_i$, at each round delete all source components whose labels are disjoint from $R_i$; validity requires that $C_i$ be a source of the resulting graph. Put

$$U_i={Scope}_{{\mathbb{S}}_i}\left(C_i\right),{\lambda }_i={\left({\psi }_i\right)}_{U_i},{\beta }_i=\bigvee \neg {\Delta }_i.$$

The package is valid if the prefix is replay-valid and

$$I_i\vDash {\lambda }_i\cup \left\{{\beta }_i\right\}.$$

Thus the prefix reconstructs the residual stage, ${\Delta }_i$ replaces a transient SCC identifier, and $I_i$ witnesses failure of the reconstructed local obligation.

Corollary 2  

(Soundness of a local failure package). Let $\mathcal{F}=({\mathcal{C}}_{<i},{\Delta }_i,I_i).$ be a valid failure package at stage i, with reconstructed state $({\psi }_i,R_i,{\mathrm{Orig}}_i)$. Then

$${\psi }_i/\vDash \bigwedge {\Delta }_i.$$

Moreover, there exists an interpretation $J_i$ satisfying ${\psi }_i$ and falsifying an atom of ${\Delta }_i$. Writing the targets stored in the prefix as ${\Delta }_0,\dots ,{\Delta }_{i-1}$, define

$$J^{\left(i\right)}=J_i,J^{\left(j\right)}=J^{(j+1)}\cup {\Delta }_j(j=i-1,\dots ,0).$$

Then

$$J^{\left(0\right)}\vDash \mathrm{Red}[\phi ;P;Z,M]\mathit{and}{J}^{\left(0\right)}/\vDash \bigwedge (M\cap P).$$

Consequently, $M/\vDash \mathrm{CIRC}[\phi ;P;Z]$.

Proof. 

Validity gives $I_i\vDash {\left({\psi }_i\right)}_{U_i}$ and $I_i/\vDash \bigwedge {\Delta }_i.$ Corollary 1 therefore yields ${\psi }_i/\vDash \bigwedge {\Delta }_i.$ Lemma 1 constructs a model $J_i$ of ${\psi }_i$ that falsifies an atom of ${\Delta }_i$. For each preceding stage $j<i$, Proposition 4 gives $J^{\left(j\right)}\vDash {\psi }_j$ from $J^{(j+1)}\vDash {\psi }_{j+1}.$ The targets in the prefix are pairwise disjoint from ${\Delta }_i$, because each successful stage removes its target from the next verification set. Hence adding ${\Delta }_{i-1},\dots ,{\Delta }_0$ does not change the atom of ${\Delta }_i$ falsified by $J_i$. It follows that $J^{\left(0\right)}\vDash {\psi }_0$ and $J^{\left(0\right)}/\vDash \bigwedge R_0.$ The conclusion follows from Theorem 1.    □

Successful and failed local checks therefore have dual replay objects. A successful fragment $({\Delta }_i,{\kappa }_i)$ records an original-clause unsatisfiability support. A failure package $({\mathcal{C}}_{<i},{\Delta }_i,I_i)$ records the successful prefix needed to reconstruct the residual state together with a satisfying assignment for the local counterexample theory.

5.2. The Local Certification Procedure

Let $\lambda$ be a local residual clause theory, $\Delta$ be a non-empty set of atoms, and $\omega$ be the restriction of the current origin map to clauses of $\lambda$. The local verification problem is

$$\lambda \vDash \bigwedge \Delta .$$

Equivalently, with

$${\beta }_{\Delta }=\bigvee \neg \Delta ,{\mathsf{\Gamma }}_{\lambda ,\Delta }=\lambda \cup \left\{{\beta }_{\Delta }\right\},$$

the local obligation holds exactly when ${\mathsf{\Gamma }}_{\lambda ,\Delta }\vDash \perp$. A model of ${\mathsf{\Gamma }}_{\lambda ,\Delta }$ is a local counterexample.

The procedure LocalCertify$(\lambda ,\Delta ,t,\omega )$, where $t\in \{\mathrm{S}\mathrm{A}\mathrm{T},\mathrm{M}\mathrm{U}\mathrm{S}\}$, checks the satisfiability of ${\mathsf{\Gamma }}_{\lambda ,\Delta }$. If it is satisfiable, the procedure returns a countermodel. If it is unsatisfiable, the procedure first obtains a residual support $H\subseteq \lambda$ and then maps that support back to the original theory by setting

$$\kappa =\omega \left(H\right)=\left\{\omega \right(\gamma )\mid \gamma \in H\}\subseteq \phi .$$

In $\mathrm{S}\mathrm{A}\mathrm{T}$, take $H=\lambda$. In $\mathrm{M}\mathrm{U}\mathrm{S}$, choose an inclusion-minimal residual subtheory $H\subseteq \lambda$ with $H\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp$. An optional second minimization may be applied to $\omega \left(H\right)$ at the original-clause level; soundness requires only the displayed unsatisfiability condition.

Example 9.  

Using Example 8, consider the first block $L_1=\left\{p_3\right\}$ for the interpretation $M_1$. The local target is $\Delta =\left\{p_3\right\}$, and the induced local residual theory is

$$\lambda =\{{\alpha }_4:p_3\vee z_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

The residual clause ${\alpha }_5^{\prime }:\neg z_1$ is obtained from the original clause

$${\alpha }_5:q_1\vee \neg z_1$$

by evaluating the fixed atom $q_1$ under the candidate interpretation. Hence the origin map sends ${\alpha }_4$ to the original clause ${\alpha }_4$, and sends ${\alpha }_5^{\prime }$ to the original clause ${\alpha }_5$. Since

$$\{p_3\vee z_1,\neg z_1,\neg p_3\}\vDash \perp ,$$

the local obligation holds. The origin-preserving certificate fragment stores the following original clause support:

$$\kappa =\{{\alpha }_4:p_3\vee z_1,{\alpha }_5:q_1\vee \neg z_1\}\subseteq \phi .$$

During replay, κ reduces on the same scope to the residual support $\{p_3\vee z_1,\neg z_1\}$; adjoining $\neg p_3$ yields an unsatisfiable theory.

Proposition 6.  

Let λ be a local residual theory at a stage with verification target R, scope U, and origin map ω. Let $\Delta \ne \varnothing$, and let

$${\beta }_{\Delta }=\bigvee \neg \Delta .$$

If Algorithm 1 returns $(\mathbf{proved},\kappa )$, then

$$\kappa \subseteq \phi \mathit{and}{\left(\mathrm{Red}[\kappa ;R;Z,M]\right)}_U\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp .$$

Consequently,

$$\lambda \vDash \bigwedge \Delta .$$

If it returns $(\mathbf{refuted},I)$, then

$$I\vDash \lambda \mathit{and}I/\vDash \bigwedge \Delta .$$

Algorithm 1: LocalCertify$(\lambda ,\Delta ,t,\omega )$

Proof. 

If the algorithm returns $(\mathbf{refuted},I)$, then $I\vDash \lambda \cup \left\{{\beta }_{\Delta }\right\}$, which immediately gives the stated local countermodel property. If the algorithm returns $(\mathbf{proved},\kappa )$, it has selected a residual support $H\subseteq \lambda$ such that $H\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp$ and then mapped H back to original clauses through $\omega$. By the defining invariant of the representative origin map, reducing each clause in $\kappa =\omega \left(H\right)$ at the same stage and restricting to the same scope reproduces the corresponding clause of H. Hence H is contained in the replayed residual support, and

$${\left(\mathrm{Red}[\kappa ;R;Z,M]\right)}_U\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp .$$

This implies $\lambda \cup \left\{{\beta }_{\Delta }\right\}\vDash \perp$, and therefore $\lambda \vDash \bigwedge \Delta$.    □

5.3. Main Checker

Algorithm 1 certifies a single source-component obligation. We now combine these local checks into a complete checker for the fixed candidate interpretation M. At the beginning of each iteration, the checker maintains the set R of minimized atoms that remain to be certified, the current residual reduct $\psi$, a representative origin map from clauses of $\psi$ to clauses of $\phi$, and the certificate prefix $\mathcal{C}$ already obtained. It exposes a source component whose label intersects R, constructs the corresponding ancestor scope, and invokes Algorithm 1 on the induced local theory. A successful local check appends the fragment $(\Delta ,\kappa )$ and contracts $\Delta$; a failed check returns the replay-valid prefix together with the current local countermodel, as specified in Definition 10. Algorithm 2 gives the resulting iterative procedure and implements the source-component decomposition established in Theorem 3.    

Algorithm 2: CheckMinMRCirc$(\phi ,P,Z,M,t)$

After deleting $\Delta$ from R, the update $\psi \leftarrow \mathrm{Red}[\psi ;R;Z,M]$ is correct by Proposition 3. The representative origin map records one provenance choice for each residual clause and does not alter the entailment test.

Example 10.  

Run Algorithm 2 on Example 8 with $M_1=\{p_1,p_2,p_3\}$ and $t=\mathrm{M}\mathrm{U}\mathrm{S}$. The first selected source component has target ${\Delta }_0=\left\{p_3\right\}$ and local residual theory

$${\lambda }_0=\{{\alpha }_4:p_3\vee z_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

As shown in Example 9, this local obligation is certified by the original support

$${\kappa }_0=\{{\alpha }_4:p_3\vee z_1,{\alpha }_5:q_1\vee \neg z_1\}\subseteq \phi .$$

The checker records $(\left\{p_3\right\},{\kappa }_0)$, contracts $p_3$, and recomputes the residual reduct. The next non-empty source component has target ${\Delta }_1=\{p_1,p_2\}$, scope $U_1=\{p_1,p_2\}$, and local residual theory

$${\lambda }_1=\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3^{\prime }:p_1\}.$$

An inclusion-minimal original support is

$${\kappa }_1=\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_3:p_1\vee \neg p_3\}.$$

At the second stage,

$${\left(\mathrm{Red}[{\kappa }_1;\{p_1,p_2\};Z,M_1]\right)}_{U_1}=\{\neg p_1\vee p_2,p_1\},$$

and

$$\{\neg p_1\vee p_2,p_1,\neg p_1\vee \neg p_2\}\vDash \perp .$$

After contracting $\{p_1,p_2\}$, the verification target is empty and the checker returns $(\mathbf{true},\mathcal{C})$, where

$$\mathcal{C}=\langle (\left\{p_3\right\},{\kappa }_0),(\{p_1,p_2\},{\kappa }_1)\rangle .$$

Replay first reconstructs the stage-zero scope and verifies

$$\{p_3\vee z_1,\neg z_1,\neg p_3\}\vDash \perp .$$

It then contracts $\left\{p_3\right\}$, reconstructs $U_1$ and ${\lambda }_1$, and verifies the second unsatisfiability condition displayed above. Thus the example traces the complete sequence from the initial reduct through component selection, support generation, contraction, and certificate replay.

The parameter t affects only support extraction. The SAT variant uses $H=\lambda$; the MUS variant chooses an inclusion-minimal $H\subseteq \lambda$ with $H\cup \{\bigvee \neg \Delta \}\vDash \perp$. In both cases, the stored support is $\kappa =\omega \left(H\right)\subseteq \phi$.

Theorem 4  

(Soundness and completeness). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$, and $t\in \{\mathrm{S}\mathrm{A}\mathrm{T},\mathrm{M}\mathrm{U}\mathrm{S}\}$. Then Algorithm 2 on input $(\phi ,P,Z,M,t)$ returns

$$(\mathbf{true},\mathcal{C})$$

if and only if

$$M\vDash \mathrm{CIRC}[\phi ;P;Z].$$

Equivalently, it returns

$$(\mathbf{false},\mathcal{F})$$

only if

$$M/\vDash \mathrm{CIRC}[\phi ;P;Z].$$

Moreover, every successful certificate fragment ${\kappa }_i$ in $\mathcal{C}$ is a subset of the original clause theory φ whose replayed reduct certifies the corresponding local target.

Proof. 

By Theorem 1,

$$M\vDash \mathrm{CIRC}[\phi ;P;Z]⟺\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge (M\cap P).$$

At each iteration, Theorem 3 gives the one-step equivalence between the current residual entailment, the scoped obligation, and the entailment for the next reduct. Since every successful step removes a non-empty block from the finite target, repeated application of the theorem reduces the initial entailment to the conjunction of the scoped obligations generated by Algorithm 2. Proposition 6 shows that a return value $(\mathbf{proved},{\kappa }_i)$ establishes the corresponding obligation and that $(\mathbf{refuted},I)$ supplies a model of its negation. Therefore the algorithm returns $\mathbf{true}$ exactly when every generated obligation holds. The inclusion ${\kappa }_i\subseteq \phi$ and the replay condition follow from Definition 9 and Proposition 6. □

The correctness theorem separates the semantic decision from the form of the recorded support. SAT and MUS certification establish the same local entailments and therefore induce the same Boolean result; they differ only in the residual support selected for replay.

Remark 1.  

The semantics is independent of the certification mode. A certificate stores $\kappa \subseteq \phi$; its validity is the stage-specific replay condition in Definition 9.

6. Experimental Evaluation

The experimental evaluation addresses Boolean agreement with the global reduct criterion, the relative size of scoped obligations, the size of origin-preserving supports, and certificate replayability.

6.1. Evaluation Questions

Q1. 

Do the decomposition variants agree with the global entailment test?

Q2. 

What fraction of the current residual reduct occurs in a scoped obligation?

Q3. 

How do SAT and MUS certification compare in accumulated support size?

Q4. 

Does every returned certificate satisfy the replay condition?

6.2. Methods

The following methods are compared.

(i)

GlobalReduct tests

$$\mathrm{Red}[\phi ;P;Z,M]\vDash \bigwedge (M\cap P).$$

(ii)

Decomp-SAT executes Algorithm 2 with $t=\mathrm{SAT}$ and retains the complete local residual theory as the residual support.

(iii)

Decomp-MUS executes the same algorithm with $t=\mathrm{MUS}$ and extracts an inclusion-minimal residual support before applying the origin map.

• The two decomposition methods generate identical scoped obligations; they differ only in support extraction.

6.3. Instances and Implementation

The benchmark set comprises 5445 solved random 3CNF instances and 462 solved industrial CNF instances derived from the data used in [17]. Each input is a quadruple $(\phi ,P,Z,M)$ with $M\vDash \phi$. The experiments therefore isolate the model-checking and certificate-generation phases.

All runs were performed on an Intel(R) Core(TM) i7-10700F CPU at 2.90 GHz with 8 physical cores, 16 logical cores, and 32 GB of memory under Ubuntu 26.04. PicoSAT 960 was used for both the global entailment test and every local SAT call, while the PicoMUS utility distributed with PicoSAT 960 was used for MUS extraction. The three methods were run sequentially on the same inputs and machine; no portfolio execution or parallel solver calls were used. At each iteration, all current source components disjoint from the target were removed round by round from a working copy of the collapsed graph. The checker recorded the selected component through the set $\Delta =\mathrm{lab}\left(C\right)\cap R$; replay reconstructed the current graph and verified that the recorded component was selectable by the same procedure. When several predecessor clauses produced the same residual clause, the implementation selected the first predecessor in the fixed input-clause order. The selected target block was stored in the certificate, so replay did not depend on an external ordering of source components; representative-origin propagation was deterministic.

Reported runtimes are arithmetic means over solved instances and include the complete execution of each compared method. Certificate-size and replay statistics are computed over runs that returned a successful certificate; a replay success is counted only when every fragment of that certificate passes the stage-specific unsatisfiability test. The benchmark collections form fixed corpora rather than samples drawn for statistical inference. Accordingly, the reported means, maxima, factors, and percentage reductions are interpreted as descriptive summaries of these corpora; no population-level confidence claim is made.

6.4. Measurements

For each instance, we record the Boolean result and runtime of each method. For

$$\psi =\mathrm{Red}[\phi ;P;Z,M],R=M\cap P,$$

we record $\left|\phi \right|$, $\left|\psi \right|$, $\left|P\right|$, $\left|Z\right|$, the number of SCCs, and the largest SCC. At iteration i, we record

$$\left|U_i\right|,|{\Delta }_i|,|{\lambda }_i|,{\displaystyle \frac{|{\lambda }_i|}{|{\psi }_i|}}.$$

For a successful certificate $\mathcal{C}={\langle ({\Delta }_i,{\kappa }_i)\rangle }_{i<m},$ we record

$$m,\sum _{i<m}\left|{\kappa }_i\right|,{\displaystyle \frac{{\sum }_{i<m}\left|{\kappa }_i\right|}{\left|\phi \right|}}.$$

The summation counts a clause once for each certificate fragment in which it occurs. Replay verifies, for every $i<m$,

$${\left(\mathrm{Red}[{\kappa }_i;R_i;Z,M]\right)}_{U_i}\cup \left\{\bigvee \neg {\Delta }_i\right\}\vDash \perp .$$

6.5. Results

Table 2. Correctness and runtime comparison.

Family	#Inst.	Global Solved	SAT Correct	MUS Correct	Global Time ms	SAT Time ms	MUS Time ms
Random 3CNF	5445	5445	5445	5445	0.046	16.271	157.274
Industrial CNF	462	462	462	462	29.563	34,435.429	539,509.732

reports agreement with the global criterion and mean runtime.

Table 3. Reduct and dependency-graph structure.

Family	Avg. $\left|\mathit{\phi }\right|$	Avg. $\left|\mathit{\psi }\right|$	Avg. $\left|\mathit{P}\right|$	Avg. $\left|\mathit{Z}\right|$	Avg. #SCC	Avg. Max SCC	Avg. Reduct Ratio
Random 3CNF	1827.893	555.589	156.545	156.545	119.750	255.379	0.302
Industrial CNF	156,871.643	37,323.433	6263.712	6273.506	3263.699	10,145.747	0.255

reports the initial reduct and graph statistics.

Table 4. Local obligation sizes.

Family	Mode	Avg. $|{\mathit{U}}_{\mathit{i}}|$	Avg. $|{\Delta }_{\mathit{i}}|$	Avg. $|{\mathit{\lambda }}_{\mathit{i}}|$	Avg. $\left|{\mathit{\lambda }}_{\mathit{i}}\right|/\left|{\mathit{\psi }}_{\mathit{i}}\right|$	Max. $\left|{\mathit{\lambda }}_{\mathit{i}}\right|$
Random 3CNF	SAT	79.747	2.486	157.029	0.407	2483
Random 3CNF	MUS	79.747	2.486	157.029	0.407	2483
Industrial CNF	SAT	3312.655	8.334	10,244.507	0.272	385,375
Industrial CNF	MUS	3312.655	8.334	10,244.507	0.272	385,375

gives the scoped-obligation statistics.

Table 5. Origin-preserving certificate statistics over successful certificate-producing runs.

Family	Mode	Avg. $\left|\mathcal{C}\right|$	Avg. ${\sum }_{\mathit{i}}\left|{\mathit{\kappa }}_{\mathit{i}}\right|$	Avg. ${\sum }_{\mathit{i}}|{\mathit{\kappa }}_{\mathit{i}}|/|\mathit{\phi }|$	Reduction vs. SAT (%)	Replay Success (%)	Avg. Replay Time ms
Random 3CNF	SAT	24.757	3887.578	1.723	–	100.000	6.354
Random 3CNF	MUS	24.757	100.541	0.055	97.414	100.000	1.924
Industrial CNF	SAT	175.900	1,802,013.264	6.838	–	100.000	8152.697
Industrial CNF	MUS	175.900	2760.537	0.030	99.847	100.000	1835.944

reports support size and replay.

6.6. Analysis

All 5907 instances satisfy

$$DecompSAT(\phi ,P,Z,M)=DecompMUS(\phi ,P,Z,M)=GlobalReduct(\phi ,P,Z,M).$$

Hence all three methods return identical Boolean values on the complete test set.

The mean initial reduct ratios are $0.302$ for random 3CNF and $0.255$ for industrial CNF. The corresponding mean scoped ratios $\left|{\lambda }_i\right|/\left|{\psi }_i\right|$ are $0.407$ and $0.272$. The mean target sizes are $2.486$ and $8.334$. These ratios quantify the mean fraction of the current residual theory retained by a source-component obligation. The maximum industrial scoped theory contains $\mathrm{385,375}$ clauses, indicating that a large SCC or ancestor scope can eliminate most of the potential localization.

For random 3CNF, MUS extraction decreases the mean accumulated support from $3887.578$ to $100.541$; the mean SAT support is therefore $38.67$ times the mean MUS support, corresponding to a reduction of approximately $97.4\%$. For industrial CNF, the mean decreases from $1802013.264$ to $2760.537$; the mean SAT support is $652.78$ times the mean MUS support, and the relative reduction is approximately $99.85\%$. Every returned certificate satisfies the replay condition.

The runtime data distinguish Boolean decision from certificate construction. GlobalReduct performs a single entailment test. The decomposition methods also construct scopes, recompute reducts, maintain origin maps, and replay local supports; Decomp-MUS additionally performs MUS extraction. The measurements therefore identify the intended trade-off: the global criterion remains the faster procedure when only the Boolean decision is required, whereas the decomposition methods incur additional cost to produce local, replayable proof objects.

7. Discussion

The extent of localization is governed by the collapsed graph ${\mathbb{S}}_{\psi [R;Z]}$, where $\psi =\mathrm{Red}[\phi ;P;Z,M]$ and $R=M\cap P$, together with the corresponding residual graphs at later stages. Small selected components with small ancestor scopes induce local theories substantially smaller than the current residual reduct. Conversely, a dominant SCC or a large ancestor scope yields an obligation close in size to the current residual theory. This limitation follows directly from the scope definition and is reflected in the maximum industrial scoped-theory size.

The certificate is independent of transient SCC and clause identifiers. Each fragment stores a stage-local dependency block ${\Delta }_i$ and a set ${\kappa }_i\subseteq \phi$. Replay reconstructs the residual state from the preceding blocks, identifies the current component $C_i$, derives its scope $U_i$ and local theory, and then verifies the stage-specific unsatisfiability condition. A single representative origin per residual clause is sufficient because the checker constructs one support and does not enumerate all provenance alternatives.

The current implementation recomputes the residual reduct and collapsed graph after every successful obligation. It also performs MUS extraction independently at each stage. Incremental reduct maintenance, incremental SCC updates, and proof-producing SAT/MUS interfaces are the principal directions for reducing this overhead.

8. Conclusions

We established a source-component decomposition of the minimal-reduct entailment characterizing propositional circumscription models. The repeated deletion of target-free source components guarantees that a target-bearing source is eventually exposed whenever the current verification target is non-empty. The scoped-countermodel extension lemma establishes semantic locality over ancestor scopes, and the contraction results yield equivalence between the sequence of scoped obligations and the global entailment.

The resulting algorithm is sound and complete. A successful run returns

$$\mathcal{C}={\langle ({\Delta }_i,{\kappa }_i)\rangle }_i,{\kappa }_i\subseteq \phi ,$$

with a formally specified replay condition. A failed run returns the replayable successful prefix, the stage-local target at which checking fails, and a scoped countermodel.

On the evaluated instances, the SAT and MUS variants agree with the global criterion, and every returned certificate satisfies the replay condition. MUS extraction yields substantially smaller original-clause supports at the cost of higher runtime.

The following directions warrant further investigation.

(i)

Incremental maintenance. Develop incremental algorithms for maintaining the residual reduct and collapsed dependency graph. A corresponding complexity analysis should bound the update cost in terms of the clauses and strongly connected components affected by each contraction.

(ii)

Parallel certification. Investigate parallel certification of incomparable source components. Correctness requires sufficient conditions under which local contractions commute and independently generated certificate fragments admit deterministic composition.

(iii)

Extensions of the semantic setting. Extend the decomposition to prioritized or nested circumscription and, over finite or bounded domains, to first-order circumscription. Such extensions require suitable reduct characterizations and scope-preservation theorems.