Decomposition-Based Checking and Local Revision for Propositional Circumscription via Minimal Reducts

1. Introduction

Circumscription is one of the classical formalisms of non-monotonic reasoning. It was introduced to capture closed-world and common-sense reasoning by making selected predicates minimal while keeping the background theory satisfied [1,2,3,4]. In the propositional case, a circumscription instance separates atoms into minimized atoms, varied atoms, and fixed atoms. A model is selected when no other model of the theory agrees on the fixed atoms and is strictly smaller on the minimized atoms, while varied atoms are allowed to change.

This apparently simple ordering condition induces a global minimality test. Given a clause theory $\phi$, disjoint sets P and Z, and a candidate interpretation M, one has to exclude every model N of $\phi$ such that N agrees with M on the fixed atoms and satisfies $N\cap P⊈M\cap P$. This global comparison is a central source of computational difficulty. It also makes the checking result structurally opaque: a Boolean answer alone does not explain which part of the residual theory forces each minimized atom to remain true, which dependency component is responsible for a local obligation, or which original clauses support the verification.

Existing computation-oriented approaches to circumscription either transform the problem into other non-monotonic formalisms, reduce reasoning to SAT or MaxSAT calls, eliminate classes of predicates, or exploit structural information in the input theory [5,6,7,8,9,10]. These methods provide useful computational foundations, but a direct decision procedure usually returns only a yes/no answer. For applications in which a candidate model must be checked, explained, or independently replayed, one also needs to expose the local structure of the minimality test and to identify the original clauses that support each verified obligation.

We focus on the model-checking problem for propositional circumscription over clause theories. The semantic starting point is the minimal reduct for propositional circumscription [11]. Relative to a candidate model, the reduct removes clauses and literals that cannot contribute to a strictly smaller admissible countermodel, and it transforms the global minimality condition into an entailment problem over a residual theory. We do not change the reduct. Instead, we refine its entailment test so that the checker exposes where each local obligation comes from and which original clauses support it.

The question is how to decompose the residual entailment test into local obligations, and how to represent each verified obligation by a support in the original input theory. We use the collapsed negative dependency graph of the minimal reduct. Strongly connected components collect residual literals that must be treated together, while source components can be checked before the components that depend on them. Each successful local check contracts verified minimized atoms and contributes a certificate fragment $(C_i,{\kappa }_i)$, where $C_i$ is the selected component and ${\kappa }_i\subseteq \phi$ is a support over original clauses. The auxiliary objects $U_i$, ${\Delta }_i$, and ${\lambda }_i$ are reconstructed during replay and need not be stored in the certificate.

The algorithmic layer is separated from the semantics. The decomposition theorem gives local obligations that are necessary and sufficient for the residual entailment test. The checker processes source components, contracts verified minimized atoms, and recomputes the residual reduct. Each local obligation is certified by one of two fixed strategies: a direct SAT check of the counterexample formula, or a MUS strategy that extracts an unsatisfiable subtheory before mapping the selected residual clauses back to original clauses. The MUS strategy is not meant to be faster; it is used to obtain smaller original-clause supports.

The principal contributions of this paper are threefold.

(i)

We establish a decomposition theorem for the minimal-reduct characterization of propositional circumscription. The theorem shows that the residual entailment condition for a candidate model can be replaced by local entailment obligations induced by the collapsed negative dependency graph of the reduct.

(ii)

We derive a source-component checking procedure from the theorem. The procedure verifies source components, contracts verified minimized atoms, recomputes the residual reduct, and records the selected components as the structural part of a replayable certificate.

(iii)

We define an origin-preserving certificate format in which each successful local obligation is supported by a set ${\kappa }_i\subseteq \phi$ of original clauses. We instantiate local certification with two fixed strategies, SAT and MUS, and experimentally evaluate correctness, locality, certificate compactness, and replayability on solved random 3CNF and industrial CNF instances.

The paper is organized as follows. Section 2 reviews work on circumscription computation, minimal reducts, decomposition, and certificate-oriented reasoning. Section 3 fixes the formal notation, recalls circumscription models, introduces the minimal reduct, and defines the dependency graphs used in the paper. Section 4 develops dependency partitions and proves the decomposition theorem. Section 5 gives the checking algorithm and the local certification procedures. Section 6 reports experiments on solved random 3CNF and industrial CNF instances, focusing on correctness, locality, origin-preserving certificate size, and replayability. Section 7 discusses the scope and limitations of the framework, and Section 8 concludes the paper.

2. Related Work

2.1. Circumscription and Its Computational Treatment

Circumscription was introduced as a second-order formalization of common-sense minimization [2] and was later developed for common-sense knowledge representation and reasoning about actions [3,12,13]. Early computational work studied computation and reduction techniques for circumscription, elimination of varying or fixed predicates, and the complexity of propositional closed-world reasoning [5,6,7,8,14,15]. Later work considered translations between circumscription and logic programming, including embeddings into disjunctive programs and reductions for parallel circumscription [9,16,17]. These approaches allow circumscription to be handled by existing non-monotonic reasoning systems, but the encodings can obscure the local structure of the original minimality test.

2.2. Reducts, Loop Formulas, and Stable-Model Connections

Reduct-based reasoning occurs in several non-monotonic logics. Stable model semantics for logic programs is based on a reduct construction, and the relationship between stable models and circumscription has been studied for propositional and first-order theories [18,19]. Loop formulas provide another bridge between non-monotonic semantics and classical satisfiability, especially for cyclic dependencies [20]. The minimal reduct used here is specific to propositional circumscription: it is defined relative to a candidate interpretation and keeps exactly the residual clauses relevant to the existence of a smaller admissible model [11]. We use this reduct as the semantic basis for decomposition and local verification.

2.3. Decomposition and Structure-Aware Reasoning

Graph-based decomposition has long been used to exploit structure in non-monotonic reasoning. Work on decomposing minimal models shows how dependency graphs can support incremental construction or verification of minimality [21]. In answer set programming, heuristic and domain-specific decomposition techniques have also been used to improve computation or guide search [22,23]. Splitting and modularity results for stable models provide another line of structural reasoning, although their syntactic assumptions and semantic targets differ from the reduct entailment problem considered here. We apply decomposition to the collapsed negative dependency graph of a circumscription reduct and formulate the local checks as classical entailment conditions over induced subtheories.

2.4. Solver-Based Reasoning, Certificates, and Explanation Objects

Solver-based methods are used both to compute non-monotonic models and to check certificates. Unsatisfiable-core analysis, MaxSAT techniques, and proof logging have been used in optimization-oriented reasoning and answer set computation [24,25,26,27]. Certificate and proof formats, such as inconsistency proofs for ASP, motivate replayable local objects rather than a bare Boolean answer [28]. Related work on justifications and witnesses for answer sets also shows the usefulness of extracting compact objects that explain why a model is accepted or rejected [29,30,31,32,33,34]. Our certificates are not answer-set justifications; they are sequences of local entailment obligations for circumscription. The proof-object motivation, however, is similar.

3. Preliminaries

Let $\mathcal{L}$ be a propositional language over a finite set $\mathcal{A}$ of atoms. The constants ⊥ and ⊤ are also allowed. A literal is an atom $p\in \mathcal{A}$ or its negation $\neg p$. A clause is a finite set of literals, identified with the disjunction of its elements. The empty clause is identified with ⊥. A clause theory is a finite set of clauses, identified with their conjunction. For a clause $\alpha$, we write

$${\alpha }^{+}=\mathcal{A}\cap \alpha ,{\alpha }^{-}=\{p\in \mathcal{A}\mid \neg p\in \alpha \}.$$

For $S\subseteq \mathcal{A}$, let $\overline{S}=\mathcal{A}\setminus S$, $\neg S=\{\neg p\mid p\in S\}$, $\bigvee S={\bigvee }_{p\in S}p$, and $\bigwedge S={\bigwedge }_{p\in S}p$. An interpretation is identified with the set of atoms assigned true. Classical satisfaction is denoted by ⊧.

As usual in propositional circumscription, quantification over propositional variables is shorthand for expansion over the truth constants. Thus, if $A(z,p_1,\dots ,p_k)$ is a propositional formula, $\exists zA(z,p_1,\dots ,p_k)$ denotes $A(\top ,p_1,\dots ,p_k)\vee A(\perp ,p_1,\dots ,p_k)$, and $\forall zA(z,p_1,\dots ,p_k)$ is defined dually. The notation extends componentwise to tuples.

In the following, tuples of atoms are used for simultaneous replacement. We identify a tuple with the corresponding set when this causes no confusion. For instance, if $P=(p_1,\dots ,p_m)$ and $Z=(z_1,\dots ,z_n)$, then expressions such as $p\in P$, $P\cap M$, and $\mathcal{A}\setminus (P\cup Z)$ refer to the underlying sets of atoms. If $X=(x_1,\dots ,x_m)$ and $Y=(y_1,\dots ,y_n)$ are tuples of propositional variables of the same lengths as P and Z, respectively, then $\phi (X,Y)$ denotes the result of simultaneously replacing every $p_i$ in $\phi (P,Z)$ by $x_i$ and every $z_j$ by $y_j$. Atoms outside $P\cup Z$ are not replaced.

For tuples $P=(p_1,\dots ,p_m)$ and $X=(x_1,\dots ,x_m)$, define

$$\begin{array}{cc}\hfill X\le P& :={\displaystyle \underset{i=1}{\overset{m}{\bigwedge }}}(x_i\to p_i),\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill X=P& :={\displaystyle \underset{i=1}{\overset{m}{\bigwedge }}}(x_i\leftrightarrow p_i),\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill X<P& :=(X\le P)\wedge \neg (X=P).\hfill \end{array}$$

(3)

Thus $X<P$ is a formula expressing that the comparison tuple is componentwise no larger than P and strictly smaller in at least one component.

Example 1.

Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and clause theory

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

When simultaneous replacement is used, take the displayed orders $P=(p_1,p_2,p_3)$ and $Z=\left(z_1\right)$. If $X=(x_1,x_2,x_3)$ and $Y=\left(y_1\right)$, then $\phi (X,Y)$ is the clause theory

$$\{\neg x_1\vee x_2,x_1\vee \neg x_2,x_1\vee \neg x_3,x_3\vee y_1\}.$$

No atom outside $P\cup Z$ occurs in this example; in general, such atoms are not replaced.

Definition 1

(Parallel circumscription). Let P and Z be disjoint tuples of atoms, and $\phi (P,Z)$ be a propositional formula. The parallel circumscription of P in φ with Z allowed to vary is

$$CIRC[\phi (P,Z);P;Z]:=\phi (P,Z)\wedge \neg \exists X\exists Y\left(\phi (X,Y)\wedge X<P\right).$$

(4)

When $Z=\varnothing$, we write $CIRC[\phi ;P]$.

The atoms in P are minimized, the atoms in Z are varied, and the atoms in $\mathcal{A}\setminus (P\cup Z)$ are fixed. The following model-theoretic order is the semantic counterpart of the syntactic comparison $X<P$.

Definition 2

(Interpretation ordering). Let $P,Z\subseteq \mathcal{A}$ be disjoint, and $M,N\subseteq \mathcal{A}$ be interpretations. We write $N{\le }^{P;Z}M$ if

$$N\cap P\subseteq M\cap P\mathrm{and}N\setminus (P\cup Z)=M\setminus (P\cup Z).$$

We write $N{<}^{P;Z}M$ if $N{\le }^{P;Z}M$ and $M\neg {\le }^{P;Z}N$.

Definition 3

(Circumscription model). An interpretation M is a model of $CIRC[\phi ;P;Z]$, written $M\vDash CIRC[\phi ;P;Z]$, if $M\vDash \phi$ and there is no model N of φ such that $N{<}^{P;Z}M$.

Example 2

(Effect of varied atoms). Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and clause theory

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

The interpretation $M=\{p_1,p_2,p_3\}$ satisfies φ. However, $N=\left\{z_1\right\}$ also satisfies φ, and

$$N\cap P=\varnothing ⊈P=M\cap P,N\setminus (P\cup Z)=M\setminus (P\cup Z)=\varnothing .$$

Thus $N{<}^{P;Z}M$. The atom $z_1$ is allowed to change because it is varied, while the minimized atoms in P become strictly smaller. Hence M is not a model of $CIRC[\phi ;P;Z]$.

The syntactic formula $X<P$ and the semantic relation ${<}^{P;Z}$ will be used in different contexts: the former occurs in the second-order definition of circumscription, while the latter compares interpretations. In the algorithmic part, the active minimizing set may be replaced by a subset $R\subseteq P$. Expressions such as $Red[\phi ;R;Z,M]$ are then understood in the same sense as Definition 4, with R taking the role of the currently minimized atoms; atoms in $P\setminus R$ are treated as fixed in the residual test.

Minimal reducts.

The minimal reduct used below is the reduct for propositional circumscription introduced in [11]. It is used here as a model-checking device: relative to a candidate interpretation, it keeps precisely the residual clauses that may still rule out interpretations smaller under ${<}^{P;Z}$.

Definition 4

(Minimal reduct). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint, and $M\subseteq \mathcal{A}$ be an interpretation. For each clause $\alpha \in \phi$, define

$$Red[\alpha ;P;Z,M]=\left({\alpha }^{+}\cap ((P\cap M)\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap ((P\cap M)\cup Z)\right)$$

(5)

provided that the following conditions hold:

(i)

${\alpha }^{-}\cap P\cap \overline{M}=\varnothing$;

(ii)

${\alpha }^{+}\cap \overline{P\cup Z}\cap M=\varnothing$;

(iii)

${\alpha }^{-}\cap \overline{P\cup Z}\cap \overline{M}=\varnothing$.

If one of these conditions fails, set $Red[\alpha ;P;Z,M]=\top$, meaning that the clause is omitted from the reduct. The minimal reduct of φ with respect to $P,Z,M$ is

$$Red[\phi ;P;Z,M]=\{Red[\alpha ;P;Z,M]\mid \alpha \in \phi ,Red[\alpha ;P;Z,M]\ne \top \}.$$

Only minimized atoms true in M and varied atoms remain as active atoms of the reduct. Fixed atoms are evaluated according to M, and minimized atoms false in M cannot become true in an interpretation smaller than M on P.

Example 3.

Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and clause theory

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

For the candidate interpretation $M=\{p_1,p_2,p_3\}$, all minimized atoms are active, that is, $P\cap M=P$, and there are no fixed atoms in this example. Hence each clause satisfies the side conditions of Definition 4, and

$$Red[\phi ;P;Z,M]=\phi .$$

For comparison, if $N=\left\{z_1\right\}$, then $P\cap N=\varnothing$. The clauses ${\alpha }_1$, ${\alpha }_2$, and ${\alpha }_3$ are omitted by condition (i), while ${\alpha }_4=p_3\vee z_1$ reduces to $z_1$. Thus

$$Red[\phi ;P;Z,N]=\left\{z_1\right\}.$$

This illustrates that the reduct is determined jointly by the candidate interpretation and by the roles of minimized and varied atoms.

The example illustrates only the syntactic effect of the reduct. The next two propositions make explicit the semantic correspondence between the original theory and its reduct. This correspondence is needed because the reduct is not merely a syntactic simplification: it must preserve exactly the smaller interpretations relevant to the circumscription test.

Proposition 1

(Preservation of smaller models). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M].$$

If $N\vDash \phi$ and $N{<}^{P;Z}M$, then $N\vDash \psi$.

Proof. 

Let $\gamma \in Red[\phi ;P;Z,M]$ be derived from a clause $\alpha \in \phi$. Thus

$$\gamma =\left({\alpha }^{+}\cap ((P\cap M)\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap ((P\cap M)\cup Z)\right),$$

and the three side conditions in Definition 4 hold for $\alpha$. Suppose, for a contradiction, that $N⊭\gamma$. Then

$$N\cap \left({\alpha }^{+}\cap ((P\cap M)\cup Z)\right)=\varnothing \mathrm{and}{\alpha }^{-}\cap ((P\cap M)\cup Z)\subseteq N.$$

We show that all omitted literals of $\alpha$ are false in N as well. Since $N{<}^{P;Z}M$, we have $N\cap P\subseteq M\cap P$ and $N\setminus (P\cup Z)=M\setminus (P\cup Z)$. For positive atoms omitted from $\gamma$,

$${\alpha }^{+}\setminus ((P\cap M)\cup Z)\subseteq (P\setminus M)\cup \overline{P\cup Z}.$$

The part in $P\setminus M$ is false in N because $N\cap P\subseteq M\cap P$, and the fixed part ${\alpha }^{+}\cap \overline{P\cup Z}$ is false in N by agreement with M together with condition (ii), namely ${\alpha }^{+}\cap \overline{P\cup Z}\cap M=\varnothing$. Hence no positive literal of $\alpha$ is true in N.

For negative literals omitted from $\gamma$, condition (i) gives ${\alpha }^{-}\cap P\cap \overline{M}=\varnothing$; hence no negative minimized atom false in M is omitted. The remaining omitted negative atoms are fixed atoms outside $P\cup Z$. By the fixed-atom agreement between N and M, condition (iii), ${\alpha }^{-}\cap \overline{P\cup Z}\cap \overline{M}=\varnothing$, implies that each such atom is true in N. Therefore every omitted negative literal is false in N. Together with $N⊭\gamma$, this yields $N⊭\alpha$, contradicting $N\vDash \phi$. Thus $N\vDash \gamma$, and since $\gamma$ was arbitrary, $N\vDash Red[\phi ;P;Z,M]$.    □

The preceding proposition gives the direction from original models to reduct models. The converse direction makes the reduct characterization complete: a model of the reduct that is no larger than the candidate on the currently minimized atoms can be lifted back to a model of the original theory.

Proposition 2

(Lifting reduct models). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$R\subseteq P,{\psi }_R=Red[\phi ;R;Z,M].$$

If $N{\le }^{R;Z}M$ and $N\vDash {\psi }_R$, then $N\vDash \phi$.

Proof. 

Let $\alpha \in \phi$. We prove that $N\vDash \alpha$.

If $Red[\alpha ;R;Z,M]\ne \top$, then $N\vDash Red[\alpha ;R;Z,M]$. Since $Red[\alpha ;R;Z,M]$ is obtained from $\alpha$ by deleting literals and leaving the retained literals unchanged, any retained literal satisfying the reduct clause is also a literal of $\alpha$. Hence $N\vDash \alpha$.

It remains to consider the case $Red[\alpha ;R;Z,M]=\top$. Then at least one side condition in Definition 4 fails. If condition (i) fails, there is an atom $p\in {\alpha }^{-}\cap R\cap \overline{M}$. Since $N\cap R\subseteq M\cap R$, we have $p\notin N$, and therefore the literal $\neg p$ satisfies $\alpha$. If condition (ii) fails, there is an atom $p\in {\alpha }^{+}\cap \overline{R\cup Z}\cap M$. Because p is fixed with respect to $R,Z$, the equality $N\setminus (R\cup Z)=M\setminus (R\cup Z)$ gives $p\in N$, so p satisfies $\alpha$. If condition (iii) fails, there is an atom $p\in {\alpha }^{-}\cap \overline{R\cup Z}\cap \overline{M}$. Again p is fixed, whence $p\notin N$, and $\neg p$ satisfies $\alpha$. In all cases $N\vDash \alpha$. Since $\alpha$ was arbitrary, $N\vDash \phi$.    □

We also record the compatibility of the reduct with contraction of the active minimizing set. This property justifies the iterative recomputation used later in the checking algorithm.

Proposition 3

(Iterated reduct consistency). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R\subseteq P\cap M.$$

Then

$$Red[\psi ;R;Z,M]\equiv Red[\phi ;R;Z,M],$$

where equivalence is understood after removing clauses reduced to ⊤ and ignoring duplicate clauses. More generally, if $R_2\subseteq R_1\subseteq P\cap M$, then

$$Red[Red[\phi ;R_1;Z,M];R_2;Z,M]\equiv Red[\phi ;R_2;Z,M].$$

Proof. 

It is enough to prove the general statement. Fix a clause $\alpha \in \phi$. A one-step reduction with active minimizing set $R_2$ retains exactly the literals of $\alpha$ whose atoms belong to $(R_2\cap M)\cup Z=R_2\cup Z$, provided that no omitted literal is already forced to make $\alpha$ true or false by the side conditions of Definition 4.

Consider instead the two-step reduction through $R_1$. The first reduction retains only literals over $R_1\cup Z$. The second reduction then evaluates every atom in $R_1\setminus R_2$ according to M and retains only literals over $R_2\cup Z$. Since $R_2\subseteq R_1\subseteq M$, a positive occurrence of an atom in $R_1\setminus R_2$ is treated exactly as a fixed positive atom true in M, and a negative occurrence of such an atom is treated exactly as a fixed negative literal false in M. Therefore the side conditions that omit a clause in the two-step procedure are triggered precisely in the cases in which the corresponding side condition is triggered by the one-step reduction to $R_2$. If the clause is not omitted, the retained literals after both procedures are precisely

$$\left({\alpha }^{+}\cap (R_2\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap (R_2\cup Z)\right).$$

Thus the two reductions produce the same residual clause, or both omit it. Applying this clause-wise argument to every $\alpha \in \phi$ proves the claim.    □

The propositions above say that smaller models of the original theory are visible in the reduct, and that reduct models below the candidate lift back to models of the original theory. Hence, instead of searching directly for all smaller models of $\phi$, one may check whether the reduct forces all minimized atoms that are true in M. This yields the following characterization.

Theorem 1

(Reduct characterization). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P.$$

The following statements are equivalent:

(i)

$M\vDash CIRC[\phi ;P;Z]$;

(ii)

$\psi \vDash \bigwedge R$;

(iii)

$R=\{p\in P\mid \psi \vDash p\}$.

Proof. 

Assume first that $M\vDash CIRC[\phi ;P;Z]$ and that (ii) fails. Then there is an interpretation I satisfying $Red[\phi ;P;Z,M]$ and falsifying some $p\in M\cap P$. Define

$$N=(I\cap ((P\cap M)\cup Z\left)\right)\cup (M\setminus (P\cup Z\left)\right).$$

The reduct contains only atoms from $(P\cap M)\cup Z$, so $N\vDash Red[\phi ;P;Z,M]$. Moreover, $N{\le }^{P;Z}M$, and the containment on P is strict because $p\notin N$. By Proposition 2, $N\vDash \phi$. Hence $N{<}^{P;Z}M$ is a smaller model of the original theory, contradicting $M\vDash CIRC[\phi ;P;Z]$.

Conversely, assume (ii), and suppose that M is not a circumscription model. Then there exists $N\vDash \phi$ such that $N{<}^{P;Z}M$. By Proposition 1, $N\vDash Red[\phi ;P;Z,M]$. Since $N\cap P⊈M\cap P$, some atom in $M\cap P$ is false in N, contradicting (ii). Thus (i) and (ii) are equivalent. Finally, (ii) and (iii) are equivalent because atoms in $P\setminus M$ are not active minimized atoms in the reduct, whereas the active minimized atoms are exactly $M\cap P$. This proves the theorem.    □

Example 4

(Using the reduct characterization). Continue Example 3 with $M=\{p_1,p_2,p_3\}$. Since $Red[\phi ;P;Z,M]=\phi$, the interpretation $N=\left\{z_1\right\}$ is a model of the reduct. In particular,

$$N⊭p_1,N⊭p_2,N⊭p_3.$$

Therefore $Red[\phi ;P;Z,M]⊭\bigwedge P\cap M$. By Theorem 1, M is not a circumscription model. This is the entailment-form version of the comparison $\left\{z_1\right\}{<}^{P;Z}\{p_1,p_2,p_3\}$ from Example 2.

Theorem 1 changes the model-checking task. Instead of comparing M with all smaller models of the original theory, it is enough to test a classical entailment condition over the reduct. We next associate a dependency graph with the active literals of this reduct.

Dependency graphs.

The decomposition below uses a dependency graph associated with a clause theory. The convention is based on negative dependencies and is compatible with loop-formula treatments of circumscription [20] as well as graph-based approaches to minimal-model construction [21].

The following definition treats active graph vertices as signed objects. Minimized atoms are represented by their positive vertices, whereas varied atoms are represented by both positive and negative vertices. Whenever a clause is later tested for membership in an induced subtheory, however, occurrence is understood at the level of atoms: an atom is counted as occurring in the clause whether it appears positively or negatively.

Definition 5

((Negative) dependency graph). Let φ be a clause theory, P and Z be two disjoint sets of atoms. The negative dependency graph of φ on P with Z is the directed graph

$${\mathbb{G}}_{\phi [P;Z]}=(V,E),$$

where

$$V=P\cup Z\cup \neg Z$$

and

$$E=\{(l_1,l_2)\mid \exists \alpha \in \phi \mathrm{such}\mathrm{that}\{\neg l_1,l_2\}\subseteq \alpha \}.$$

Here $\neg (\neg z)$ is identified with z for $z\in Z$. Thus, for example, a clause containing z and p induces the edge $\neg z\to p$.

Given a circumscription $CIRC[\phi ;P;Z]$ and a non-empty set $L\subseteq P$, L is called a loop of $CIRC[\phi ;P;Z]$ if, for any $p,q\in L$, there exists a path of non-zero length from p to q in ${\mathbb{G}}_{\phi [P;Z]}$ such that all vertices in the path belong to

$$L\cup Z\cup \neg Z.$$

Given a directed graph $G=(V,E)$, the collapsed dependency graph ${\mathbb{S}}_G=(\mathbb{V},\mathbb{E})$ of G is the directed acyclic graph (DAG) defined as follows:

• $\mathbb{V}$ is the set of strongly connected components (SCCs) of G. That is, every $C\in \mathbb{V}$ is a maximal subgraph $G^{\prime }=(V^{\prime },E^{\prime })$ of G such that $G^{\prime }$ has a path from any vertex $v^{\prime }\in V^{\prime }$ to every other vertex in $V^{\prime }$. When no confusion arises, we also denote such a component $G^{\prime }$ by its vertex set $V^{\prime }$.
• $\mathbb{E}$ consists of all edges $(C,C^{\prime })$ such that $C,C^{\prime }\in \mathbb{V}$, $C\ne C^{\prime }$, and there exist vertices $u\in C$ and $v\in C^{\prime }$ with $(u,v)\in E$.

For a clause theory $\phi$ and two disjoint sets of atoms $P,Z$, we write

$${\mathbb{S}}_{\phi [P;Z]}$$

instead of ${\mathbb{S}}_{{\mathbb{G}}_{\phi [P;Z]}}$. When a strongly connected component C is used as a vertex of a collapsed dependency graph, $lab\left(C\right)$ denotes the set of original graph vertices represented by C.

A source S of ${\mathbb{S}}_{\phi [P;Z]}$ is called empty if $S\cap P=\varnothing$. For a component S of ${\mathbb{S}}_{\phi [P;Z]}$, let ${\phi }_S$ denote the set of clauses $\alpha \in \phi$ such that every vertex of ${\mathbb{G}}_{\phi [P;Z]}$ whose underlying atom occurs in $\alpha$ belongs to S. Here the polarity of the occurrence in $\alpha$ is ignored: if an atom p appears in $\alpha$ either as p or as $\neg p$, then the graph vertices whose underlying atom is p are treated as occurring in $\alpha$.

Example 5.

Let $P=\{p_1,p_2,p_3\}$, $Z=\left\{z_1\right\}$, and

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1\}.$$

Take $M=\{p_1,p_2,p_3\}$. Then $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M]=\phi ,R=M\cap P=P.$$

Thus ${\mathbb{G}}_{\psi [R;Z]}$ has vertex set

$$V=\{p_1,p_2,p_3,z_1,\neg z_1\}.$$

The clauses ${\alpha }_1$ and ${\alpha }_2$ induce the edges $p_1\to p_2$ and $p_2\to p_1$, respectively. The clause ${\alpha }_3$ induces the edge $p_3\to p_1$. The clause ${\alpha }_4$ contains $z_1$, and hence induces edges from $\neg z_1$ to the literals occurring with $z_1$, in particular $\neg z_1\to p_3$.

The solid part of Figure 1 shows the negative dependency graph ${\mathbb{G}}_{\psi [R;Z]}$. The dashed boxes denote the vertices of the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$, obtained by contracting strongly connected components.

Figure 1. The negative dependency graph and the collapsed dependency graph for Example 5: solid arrows denote edges of ${\mathbb{G}}_{\psi [R;Z]}$, and dashed boxes denote vertices of the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$.

Figure 1. The negative dependency graph and the collapsed dependency graph for Example 5: solid arrows denote edges of ${\mathbb{G}}_{\psi [R;Z]}$, and dashed boxes denote vertices of the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$.

For a component C of a collapsed dependency graph $\mathbb{S}$, let ${Anc}_{\mathbb{S}}\left(C\right)$ be the set of its ancestor components. Define its vertex scope by

$${Scope}_{\mathbb{S}}\left(C\right)=\bigcup _{D\in {Anc}_{\mathbb{S}}\left(C\right)\cup \left\{C\right\}}lab\left(D\right).$$

Thus ${Scope}_{\mathbb{S}}\left(C\right)$ is a set of graph vertices, not a tuple and not necessarily a set of atoms. To speak about a local obligation for a component, we also need to restrict the reduct to the clauses whose active graph vertices lie within a chosen scope.

Definition 6

(Induced subtheory). Let φ be a clause theory, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

and ${\mathbb{G}}_{\psi [R;Z]}=(V,E)$. Let $U\subseteq V$. The induced subtheory of ψ on U is

$${\psi }_U=\{\alpha \in \psi \mid \mathit{every}\mathit{vertex}\mathit{of}{\mathbb{G}}_{\psi [R;Z]}\mathit{whose}\mathit{underlying}\mathit{atom}\mathit{occurs}\mathit{in}\alpha \mathit{belongs}\mathit{to}U\}.$$

In this definition, occurrence is tested at the atom level rather than at the signed-literal level. Thus, if an atom p occurs in α either as p or as $\neg p$, then the graph vertices whose underlying atom is p are all relevant to the membership test for ${\psi }_U$.

Example 6.

Continue Example 5, where $\psi =\phi$ and $R=P$. The clauses ${\alpha }_1$ and ${\alpha }_2$ involve only the atoms $p_1$ and $p_2$, while ${\alpha }_3$ involves $p_1$ and $p_3$. The clause ${\alpha }_4$ involves the atoms $p_3$ and $z_1$. Since $z_1$ is varied, both graph vertices $z_1$ and $\neg z_1$ are relevant whenever the atom $z_1$ occurs, regardless of the polarity of its occurrence in the clause. Consequently, if

$$U=\{p_1,p_2,p_3\},$$

then

$${\psi }_U=\{{\alpha }_1,{\alpha }_2,{\alpha }_3\},$$

because ${\alpha }_4$ also depends on the varied-atom vertices $z_1$ and $\neg z_1$. If

$$U^{\prime }=\{p_3,z_1,\neg z_1\},$$

then ${\psi }_{U^{\prime }}=\left\{{\alpha }_4\right\}$.

4. Decomposition of Reduct Entailment

By Theorem 1, checking whether M is a circumscription model reduces to testing whether the minimal reduct entails every active minimized atom in $M\cap P$. This section decomposes that entailment test according to the collapsed dependency graph of the reduct. Strongly connected components are standard in graph-based treatments of recursive dependencies, but here the components are computed after the minimal reduct has been formed. The decomposition is therefore relative to the candidate interpretation and to the circumscription reduct [11,20,21].

Throughout this section, let

$$\psi =Red[\phi ;P;Z,M],R=M\cap P.$$

The set R is the active minimizing set of the reduct. The definitions below convert the graph structure into a sequence of entailment tasks. A dependency partition is not an arbitrary partition of R; it must respect the topological order of the collapsed dependency graph. This condition ensures that, when a block is checked, all blocks that can influence it have already been accounted for.

Definition 7

(Dependency partition). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

and ${\mathbb{S}}_{\psi [R;Z]}=(\mathbb{V},\mathbb{E})$ be the collapsed dependency graph. Choose any topological ordering $C_1,\dots ,C_t$ of the components in $\mathbb{V}$. Remove all empty intersections $lab\left(C_j\right)\cap R$, and write the remaining non-empty sets, in the induced order, as

$$L_1,\dots ,L_n.$$

The sequence $L_1,\dots ,L_n$ is called a dependency partition of R with Z for the reduct ψ. Each block $L_i$ consists of the active minimized atoms contained in one strongly connected component of ${\mathbb{G}}_{\psi [R;Z]}$, and the order of the blocks respects the topological order of ${\mathbb{S}}_{\psi [R;Z]}$.

For $i\ge 1$, let

$$X_i=L_1\cup \dots \cup L_{i-1},X_1=\varnothing .$$

The set $X_i$ contains the active minimized atoms already verified before layer $L_i$. For each component, the checker must justify only the minimized atoms that occur in that component. The next definition names this target and the corresponding local entailment condition.

Definition 8

(Local verification obligation). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

and $\mathbb{S}={\mathbb{S}}_{\psi [R;Z]}$. Let C be a vertex of the collapsed dependency graph $\mathbb{S}$. Define

$${\Delta }_C=lab\left(C\right)\cap R.$$

If ${\Delta }_C\ne \varnothing$, checking C amounts to the local verification obligation

$${\psi }_{{Scope}_{\mathbb{S}}\left(C\right)}\vDash \bigwedge {\Delta }_C.$$

(6)

If ${\Delta }_C=\varnothing$, then C carries no local verification obligation.

Example 7.

Continue Example 5, where

$$\psi =Red[\phi ;P;Z,M]=\phi ,R=M\cap P=P.$$

In the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$, let $C_{\neg z_1}$, $C_{z_1}$, $C_3$, and $C_{12}$ be the vertices satisfying

$$lab\left(C_{\neg z_1}\right)=\{\neg z_1\},lab\left(C_{z_1}\right)=\left\{z_1\right\},lab\left(C_3\right)=\left\{p_3\right\},lab\left(C_{12}\right)=\{p_1,p_2\}.$$

The component $C_{12}$ corresponds to the strongly connected component formed by $p_1$ and $p_2$, while $C_3$ is the singleton component containing $p_3$. The edge $p_3\to p_1$ in ${\mathbb{G}}_{\psi [R;Z]}$ induces an edge $C_3\to C_{12}$ in ${\mathbb{S}}_{\psi [R;Z]}$. The edge $\neg z_1\to p_3$ induces an edge $C_{\neg z_1}\to C_3$.

Hence the non-empty minimized components, ordered according to the collapsed dependency graph, give the dependency partition

$$L_1=lab\left(C_3\right)\cap R=\left\{p_3\right\},L_2=lab\left(C_{12}\right)\cap R=\{p_1,p_2\}.$$

For the first component $C_3$, the local target is

$${\Delta }_{C_3}=lab\left(C_3\right)\cap R=\left\{p_3\right\}.$$

The scope of $C_3$ contains the vertices needed to express the clauses relevant to $C_3$. In this example,

$${Scope}_{\mathbb{S}}\left(C_3\right)=\{p_3,z_1,\neg z_1\}.$$

Therefore the induced local theory is

$${\psi }_{{Scope}_{\mathbb{S}}\left(C_3\right)}=\{{\alpha }_4:p_3\vee z_1\}.$$

The corresponding local verification obligation is

$${\psi }_{{Scope}_{\mathbb{S}}\left(C_3\right)}\vDash \bigwedge {\Delta }_{C_3},$$

that is,

$$\{p_3\vee z_1\}\vDash p_3.$$

This obligation does not hold, since the interpretation $\left\{z_1\right\}$ satisfies $p_3\vee z_1$ but does not satisfy $p_3$. Thus the graph selects the component to be checked, while the actual local verification is a semantic entailment problem over the induced subtheory.

The local conditions are useful only if verified components can be removed without changing the remaining test. Proposition 3 already ensures that recomputing the reduct after contraction is equivalent to recomputing it directly from the original theory with the smaller active minimizing set. The next two propositions provide the remaining bookkeeping needed to transfer models between the uncontracted and contracted reducts.

Proposition 4.

Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

and $L_1,\dots ,L_n$ be a dependency partition of R with Z for ψ. For $1\le i\le n$, let

$$X_i=L_1\cup \dots \cup L_{i-1},X_1=\varnothing .$$

If $N\vDash Red[\phi ;P\setminus X_i;Z,M]$, then $N\cup X_i\vDash Red[\phi ;P;Z,M]$.

Proof. 

Let $\beta \in Red[\phi ;P;Z,M]$, and $\alpha \in \phi$ be a clause from which $\beta$ is derived. Put

$${\beta }_i=\left({\alpha }^{+}\cap (((P\setminus X_i)\cap M)\cup Z)\right)\cup \neg \left({\alpha }^{-}\cap (((P\setminus X_i)\cap M)\cup Z)\right)$$

when this clause is not omitted in $Red[\phi ;P\setminus X_i;Z,M]$. Since $X_i\subseteq R=M\cap P$, moving from P to $P\setminus X_i$ treats the atoms of $X_i$ as fixed true atoms.

If ${\beta }_i$ belongs to $Red[\phi ;P\setminus X_i;Z,M]$, then $N\vDash {\beta }_i$. The clause $\beta$ is obtained from ${\beta }_i$ by possibly adding literals whose atoms are in $X_i$. Hence $N\cup X_i\vDash \beta$ unless all satisfying literals of $\beta$ were removed by the contraction. This cannot happen: any positive atom from $X_i$ is true in $N\cup X_i$, while any negative literal over $X_i$ is false and therefore irrelevant to satisfaction. Thus $N\cup X_i\vDash \beta$.

If ${\beta }_i\notin Red[\phi ;P\setminus X_i;Z,M]$, then some side condition for the reduct with active set $P\setminus X_i$ fails. Since $\beta$ is present in the reduct with active set P, conditions involving fixed atoms outside $P\cup Z$ cannot be responsible for the failure. Nor can condition (i) fail because all atoms of $X_i$ are true in M. The only possible new failure is condition (ii), caused by a positive occurrence of an atom in $X_i$. Such an atom occurs positively in $\beta$ and is true in $N\cup X_i$. Hence $N\cup X_i\vDash \beta$ in this case as well. Since $\beta$ was arbitrary, $N\cup X_i\vDash Red[\phi ;P;Z,M]$.    □

The converse bookkeeping direction is also needed. If an interpretation already satisfies the original reduct and contains the atoms previously verified, then it remains a model after those atoms are removed from the active minimizing set.

Proposition 5.

Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

and $L_1,\dots ,L_n$ be a dependency partition of R with Z for ψ. For some $i\in \{1,\dots ,n\}$, let

$$X_i=L_1\cup \dots \cup L_{i-1},X_1=\varnothing .$$

If $N\vDash Red[\phi ;P;Z,M]$ and $X_i\subseteq N$, then $N\vDash Red[\phi ;P\setminus X_i;Z,M]$.

Proof. 

Let ${\beta }_i\in Red[\phi ;P\setminus X_i;Z,M]$, and $\alpha \in \phi$ be the original clause from which it is derived. We compare ${\beta }_i$ with the clause $\beta$ obtained from $\alpha$ in $Red[\phi ;P;Z,M]$.

First, $\beta$ cannot be omitted. If condition (i) failed for active set P, then it would also fail for $P\setminus X_i$, except possibly through an atom of $X_i$; but $X_i\subseteq M$, so no such atom is in $\overline{M}$. If condition (ii) or (iii) failed because of a fixed atom outside $P\cup Z$, the same failure would occur for $P\setminus X_i$. If condition (ii) failed because of a positive atom in $X_i$, then ${\beta }_i$ would be omitted by the contracted reduct, contrary to the choice of ${\beta }_i$. Thus $\beta \in Red[\phi ;P;Z,M]$.

Since $N\vDash Red[\phi ;P;Z,M]$, we have $N\vDash \beta$. The only literals present in $\beta$ but absent from ${\beta }_i$ have atoms in $X_i$. Positive literals over $X_i$ cannot occur, because ${\beta }_i$ would then have been omitted by condition (ii) for the contracted reduct. Negative literals over $X_i$, if present in $\beta$, are false in N because $X_i\subseteq N$. Therefore $N\vDash \beta$ must be witnessed by a literal already present in ${\beta }_i$. Hence $N\vDash {\beta }_i$. Since ${\beta }_i$ was arbitrary, $N\vDash Red[\phi ;P\setminus X_i;Z,M]$.    □

With these two preservation facts in place, the global entailment condition of Theorem 1 can be replaced by a sequence of layer-wise obligations. The next theorem states the decomposition: checking the layers one by one is equivalent to checking the whole reduct at once.

Theorem 2

(Decomposition of reduct entailment). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

and $L_1,\dots ,L_n$ be a dependency partition of R with Z for ψ. For $1\le i\le n$, let

$$X_i=L_1\cup \dots \cup L_{i-1},X_1=\varnothing .$$

Then

$$M\vDash CIRC[\phi ;P;Z]$$

if and only if, for every $i\in \{1,\dots ,n\}$,

$$Red[\phi ;P\setminus X_i;Z,M]\vDash \bigwedge L_i.$$

(7)

Proof. 

By Theorem 1, it is enough to prove that $Red[\phi ;P;Z,M]\vDash \bigwedge R$ is equivalent to the family of obligations (7).

Assume first that $Red[\phi ;P;Z,M]\vDash \bigwedge R$. Suppose, for a contradiction, that (7) fails for some i. Then there exists an interpretation N such that

$$N\vDash Red[\phi ;P\setminus X_i;Z,M]\mathrm{and}N⊭\bigwedge L_i.$$

By Proposition 4, $N\cup X_i\vDash Red[\phi ;P;Z,M]$. Since $L_i\cap X_i=\varnothing$, the interpretation $N\cup X_i$ still falsifies some atom of $L_i$. This contradicts $Red[\phi ;P;Z,M]\vDash \bigwedge R$, because $L_i\subseteq R$.

Conversely, assume that all obligations (7) hold. Let $N\vDash Red[\phi ;P;Z,M]$. We prove by induction on i that

$$L_1\cup \dots \cup L_i\subseteq N.$$

For $i=1$, we have $X_1=\varnothing$, so the first obligation says $Red[\phi ;P;Z,M]\vDash \bigwedge L_1$, and hence $L_1\subseteq N$. For the induction step, assume $X_i=L_1\cup \dots \cup L_{i-1}\subseteq N$. By Proposition 5,

$$N\vDash Red[\phi ;P\setminus X_i;Z,M].$$

The i-th obligation then gives $L_i\subseteq N$. Thus $X_{i+1}\subseteq N$. By induction, $R=L_1\cup \dots \cup L_n\subseteq N$. Since N was an arbitrary model of the original reduct, $Red[\phi ;P;Z,M]\vDash \bigwedge R$, as required.    □

The preceding theorem is stated for any dependency partition satisfying the ordering condition. An implementation does not need to construct such a partition in advance. It can repeatedly select source components of the current collapsed graph, verify their local targets, and then contract them. The next theorem gives this algorithmic form of the same decomposition principle.

Theorem 3

(Source-component form). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$${\psi }_0=Red[\phi ;P;Z,M],R_0=M\cap P.$$

Let

$${({\psi }_i,R_i,C_i,{\Delta }_i)}_{i=0}^{k-1}$$

be any finite sequence such that, for each $i<k$,

$${\mathbb{S}}_i={\mathbb{S}}_{{\psi }_i[R_i;Z]},C_i\mathit{is}a\mathit{non}\text{-}\mathit{empty}\mathit{source}\mathit{vertex}\mathit{of}{\mathbb{S}}_i,{\Delta }_i=lab\left(C_i\right)\cap R_i,$$

where “non-empty” means ${\Delta }_i\ne \varnothing$, and

$$R_{i+1}=R_i\setminus {\Delta }_i,{\psi }_{i+1}=Red[{\psi }_i;R_{i+1};Z,M].$$

If $R_k=\varnothing$ and, for every $i<k$,

$${\left({\psi }_i\right)}_{{Scope}_{{\mathbb{S}}_i}\left(C_i\right)}\vDash \bigwedge {\Delta }_i,$$

(8)

then

$$Red[\phi ;P;Z,M]\vDash \bigwedge M\cap P.$$

Conversely, if

$$Red[\phi ;P;Z,M]\vDash \bigwedge (M\cap P),$$

then every obligation of the form (8) generated by such a source-component sequence is valid.

Proof. 

At each iteration, write $\mathbb{S}$ for the current collapsed dependency graph. The iterative removal of source components induces a topological ordering of the non-empty strongly connected components encountered during the process; their target sets $\Delta =lab\left(C\right)\cap R$ form a dependency partition of the active minimized atoms. Empty sources contribute no active atom and therefore have no verification target. For a non-empty source C, the scope ${Scope}_{\mathbb{S}}\left(C\right)$ contains exactly the component and its already available ancestor components. Clauses outside this scope contain no active literal that can contribute to the entailment of $\Delta$ before later components are processed. Hence the local entailment in (8) is precisely the source-component instance of the partition obligation (7) after the previously verified atoms have been contracted. Proposition 3 identifies the dynamically recomputed reduct with the corresponding reduct from the original theory, and Propositions 4 and 5 transfer models between the contracted and uncontracted reducts. The equivalence therefore follows from Theorem 2.    □

Example 8

(Source-component checking). Let

$$P=\{p_1,p_2,p_3\},Z=\{z_1,z_2\},$$

and

$$\phi =\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3:p_1\vee \neg p_3,{\alpha }_4:p_3\vee z_1,{\alpha }_5:q_1\vee \neg z_1,{\alpha }_6:p_2\vee p_3\vee z_2\}.$$

Consider

$$M_1=\{p_1,p_2,p_3\}.$$

Then $M_1\vDash \phi$. The minimal reduct of φ with respect to $M_1$ is

$$\psi =Red[\phi ;P;Z,M_1]=\{{\alpha }_1,{\alpha }_2,{\alpha }_3,{\alpha }_4,{\alpha }_5^{\prime }:\neg z_1,{\alpha }_6\}.$$

Since

$$R=M_1\cap P=P,$$

the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$ contains two non-empty minimized components. Let $C_3$ and $C_{12}$ be the corresponding vertices of ${\mathbb{S}}_{\psi [R;Z]}$, with

$$lab\left(C_3\right)=\left\{p_3\right\},lab\left(C_{12}\right)=\{p_1,p_2\}.$$

Thus a source-component order gives the dependency partition

$$L_1=lab\left(C_3\right)\cap R=\left\{p_3\right\},L_2=lab\left(C_{12}\right)\cap R=\{p_1,p_2\}.$$

A corresponding negative dependency graph is shown in Figure 2.

Figure 2. The negative dependency graph ${\mathbb{G}}_{\psi [R;Z]}$ for Example 8: solid arrows denote edges of ${\mathbb{G}}_{\psi [R;Z]}$, and dashed boxes denote vertices of the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$.

Figure 2. The negative dependency graph ${\mathbb{G}}_{\psi [R;Z]}$ for Example 8: solid arrows denote edges of ${\mathbb{G}}_{\psi [R;Z]}$, and dashed boxes denote vertices of the collapsed dependency graph ${\mathbb{S}}_{\psi [R;Z]}$.

For the first component $C_3$, the local target is

$${\Delta }_{C_3}=lab\left(C_3\right)\cap R=\left\{p_3\right\}.$$

Its scope in the collapsed dependency graph is

$${Scope}_{{\mathbb{S}}_{\psi [R;Z]}}\left(C_3\right)=\{p_3,z_1,\neg z_1\}.$$

Hence the induced local theory is

$${\psi }_{{Scope}_{{\mathbb{S}}_{\psi [R;Z]}}\left(C_3\right)}=\{{\alpha }_4:p_3\vee z_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

The first local verification obligation is therefore

$${\psi }_{{Scope}_{{\mathbb{S}}_{\psi [R;Z]}}\left(C_3\right)}\vDash \bigwedge {\Delta }_{C_3},$$

that is,

$$\{p_3\vee z_1,\neg z_1\}\vDash p_3.$$

After this local obligation is certified, the verified atom $p_3$ is contracted. The next residual reduct is

$$Red[\phi ;P\setminus \left\{p_3\right\};Z,M_1]=\{{\alpha }_1,{\alpha }_2,{\alpha }_3^{\prime }:p_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

This residual reduct entails

$$p_1\wedge p_2.$$

Thus the global entailment

$$Red[\phi ;P;Z,M_1]\vDash p_1\wedge p_2\wedge p_3$$

is checked in two source-component steps:

$$\left\{p_3\right\}\mathrm{first},\mathrm{then}\{p_1,p_2\}.$$

This illustrates the source-component form of the decomposition theorem: the global reduct entailment is verified by checking local obligations and recomputing the residual reduct after each certified component.

The source-component theorem specifies what has to be checked locally, but it does not yet specify what the checker should return. A positive answer should come with local obligations that can be replayed, and a negative or inconclusive answer should identify the local component where the test failed. This motivates the algorithmic objects introduced next.

5. Checking Algorithm and Origin-Based Local Certification

This section gives the algorithmic form of the decomposition theorem. The procedure has two layers. The first performs source-component decomposition and generates local obligations. The second, denoted by LocalCertify, checks each obligation and returns either a local countermodel or a proof object. The word “certification” is used in this narrow sense: this layer does not revise the candidate interpretation, change the circumscription semantics, or introduce a new minimization policy.

The certificate fragment $\kappa$ is central to the checker. Since the local theory $\lambda$ is already produced by a reduct, a certificate of the form $\kappa \subseteq \lambda$ would explain the obligation only after the original clauses have been transformed. We instead trace $\kappa$ back to the original clause theory. Thus $\kappa$ is a set of original clauses of $\phi$. Replaying those original clauses through the same reduct and scope restriction reconstructs a sufficient local unsatisfiable core for the target-negation test.

5.1. Origin-Preserving Certificates and Failure Packages

During the iterative checking process, each residual clause is derived from at least one clause of the original theory. We make this bookkeeping explicit. For every residual theory ${\psi }_i$, let

$${Orig}_i\left(\gamma \right)\subseteq \phi$$

be a non-empty set of original clauses whose reduction at the current stage yields the residual clause $\gamma$, up to deletion of duplicates. For a set $\Lambda \subseteq {\psi }_i$, define

$${Orig}_i\left(\Lambda \right)=\bigcup _{\gamma \in \Lambda }{Orig}_i\left(\gamma \right).$$

If duplicate residual clauses arise from different original clauses, any fixed origin policy may be used, or all origins may be retained. The soundness statements below only require that reducing the selected origins at the same stage reproduces clauses at least as strong as the selected residual support.

Definition 9

(Origin-preserving decomposition certificate). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$,

$${\psi }_0=Red[\phi ;P;Z,M],R_0=M\cap P.$$

An origin-preserving decomposition certificate for M with respect to $CIRC[\phi ;P;Z]$ is a finite sequence

$$\mathcal{C}=\langle {\chi }_0,\dots ,{\chi }_{m-1}\rangle ,{\chi }_i=(C_i,{\kappa }_i),$$

such that there exist residual theories ${\psi }_0,\dots ,{\psi }_m$, active minimized atom sets $R_0,\dots ,R_m$, and origin maps ${Orig}_i$ satisfying the following conditions. For every $0\le i<m$, let

$${\mathbb{S}}_i={\mathbb{S}}_{{\psi }_i[R_i;Z]}.$$

Then $C_i$ is a non-empty source vertex of ${\mathbb{S}}_i$. The scope, target, and induced local theory of the fragment are not independent data; they are determined from the current residual state by

$$U_i={Scope}_{{\mathbb{S}}_i}\left(C_i\right),{\Delta }_i=lab\left(C_i\right)\cap R_i,{\lambda }_i={\left({\psi }_i\right)}_{U_i}.$$

Let

$${\beta }_i=\bigvee \neg {\Delta }_i$$

be the target-negation clause. The second component ${\kappa }_i$ of the certificate fragment is a set of original clauses satisfying

$${\kappa }_i\subseteq {Orig}_i\left({\lambda }_i\right)\mathrm{and}{\left(Red[{\kappa }_i;R_i;Z,M]\right)}_{U_i}\cup \left\{{\beta }_i\right\}\vDash \perp .$$

Moreover,

$$R_{i+1}=R_i\setminus {\Delta }_i,{\psi }_{i+1}=Red[{\psi }_i;R_{i+1};Z,M],$$

the origin map is updated consistently with this recomputation, and

$$R_m=\varnothing .$$

The condition on ${\kappa }_i$ gives the primitive form of the certificate: a subset of the original input clauses, replayed through the same reduct and scope, already forces the local target. Thus the certificate is not merely a subtheory of an intermediate reduct. It records which original formulas support each verified local obligation. The tuple $(C_i,{\kappa }_i)$ stores only the selected source component and its primitive support. The associated scope $U_i$, target ${\Delta }_i$, and residual theory ${\lambda }_i$ are recomputed during certificate replay.

Definition 10

(Failure package). Let φ, P, Z, M, ψ, and R be as above, and let $\mathbb{S}={\mathbb{S}}_{\psi [R;Z]}$. A failure package is a pair

$$\mathcal{F}=(C,I),$$

where C records the source component at which the checker stops and I is a local countermodel. The remaining objects associated with C are determined from the current residual state:

$$U={Scope}_{\mathbb{S}}\left(C\right),\Delta =lab\left(C\right)\cap R,\lambda ={\psi }_U.$$

Let

$${\beta }_{\Delta }=\bigvee \neg \Delta ,{\Gamma }_{\lambda ,\Delta }=\lambda \cup \left\{{\beta }_{\Delta }\right\}.$$

The pair $(C,I)$ is a valid failure package if

$$I\vDash {\Gamma }_{\lambda ,\Delta }.$$

The certificate and the failure package therefore have parallel but different payloads. A successful fragment $(C_i,{\kappa }_i)$ carries an original-clause support, so that the unsatisfiability proof can be replayed from primitive input formulas. A failure package $(C,I)$ carries a countermodel, because failure of a local obligation is witnessed by satisfiability of the recomputed local counterexample theory. In both cases, the component C is the only structural item that must be stored; the scope, target, and local residual theory are derived during replay.

5.2. the Local Certification Procedure

Let $\lambda$ be a local residual clause theory, $\Delta$ be a non-empty set of atoms, and $\omega$ be the restriction of the current origin map to clauses of $\lambda$. The local verification problem is

$$\lambda \vDash \bigwedge \Delta .$$

Equivalently, with

$${\beta }_{\Delta }=\bigvee \neg \Delta ,{\Gamma }_{\lambda ,\Delta }=\lambda \cup \left\{{\beta }_{\Delta }\right\},$$

the local obligation holds exactly when ${\Gamma }_{\lambda ,\Delta }\vDash \perp$. A model of ${\Gamma }_{\lambda ,\Delta }$ is a local counterexample.

The procedure LOCALCERTIFY$(\lambda ,\Delta ,t,\omega )$, where $t\in \{SAT,MUS\}$, checks the satisfiability of ${\Gamma }_{\lambda ,\Delta }$. If it is satisfiable, the procedure returns a countermodel. If it is unsatisfiable, the procedure first obtains a residual support $H\subseteq \lambda$ and then maps that support back to the original theory by setting

$$\kappa =\omega \left(H\right)\subseteq \phi .$$

In the $SAT$ variant, one may take $H=\lambda$. In the $MUS$ variant, H is chosen as an inclusion-minimal residual subtheory such that $H\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp$. Optionally, the origin set $\omega \left(H\right)$ can be minimized once more at the original-clause level. This second minimization is not required for soundness, but it yields the ideal form of $\kappa$: a smallest or irredundant set of primitive clauses from $\phi$ sufficient for the local obligation.

Example 9.

Using Example 8, consider the first block $L_1=\left\{p_3\right\}$ for the interpretation $M_1$. The local target is $\Delta =\left\{p_3\right\}$, and the induced local residual theory is

$$\lambda =\{{\alpha }_4:p_3\vee z_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

The residual clause ${\alpha }_5^{\prime }:\neg z_1$ is obtained from the original clause

$${\alpha }_5:q_1\vee \neg z_1$$

by evaluating the fixed atom $q_1$ under the candidate interpretation. Hence the origin map sends ${\alpha }_4$ to the original clause ${\alpha }_4$, and sends ${\alpha }_5^{\prime }$ to the original clause ${\alpha }_5$. Since

$$\{p_3\vee z_1,\neg z_1,\neg p_3\}\vDash \perp ,$$

the local obligation holds. The origin-preserving certificate fragment is not

$$\{p_3\vee z_1,\neg z_1\}\subseteq \lambda ,$$

but rather the original support

$$\kappa =\{{\alpha }_4:p_3\vee z_1,{\alpha }_5:q_1\vee \neg z_1\}\subseteq \phi .$$

Replaying κ through the same reduct and scope gives the local residual support $\{p_3\vee z_1,\neg z_1\}$, which together with $\neg p_3$ is unsatisfiable.

Proposition 6.

Let λ be a local residual theory at a stage with active minimized atom set R, scope U, and origin map ω. Let $\Delta \ne \varnothing$, and let

$${\beta }_{\Delta }=\bigvee \neg \Delta .$$

If Algorithm 1 returns $(\mathbf{proved},\kappa )$, then

$$\kappa \subseteq \phi \mathrm{and}{\left(Red[\kappa ;R;Z,M]\right)}_U\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp .$$

Consequently,

$$\lambda \vDash \bigwedge \Delta .$$

If it returns $(\mathbf{refuted},I)$, then

$$I\vDash \lambda \mathrm{and}I⊭\bigwedge \Delta .$$

Proof. 

If the algorithm returns $(\mathbf{refuted},I)$, then $I\vDash \lambda \cup \left\{{\beta }_{\Delta }\right\}$, which immediately gives the stated local countermodel property. If the algorithm returns $(\mathbf{proved},\kappa )$, it has selected a residual support $H\subseteq \lambda$ such that $H\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp$ and then mapped H back to original clauses through $\omega$. By the definition of the origin map, reducing $\kappa =\omega \left(H\right)$ at the same stage and restricting to the same scope reproduces the residual clauses in H, possibly together with additional residual clauses. Adding clauses preserves unsatisfiability. Hence

$${\left(Red[\kappa ;R;Z,M]\right)}_U\cup \left\{{\beta }_{\Delta }\right\}\vDash \perp .$$

This implies $\lambda \cup \left\{{\beta }_{\Delta }\right\}\vDash \perp$, and therefore $\lambda \vDash \bigwedge \Delta$.    □

5.3. Main Checker

The update $\psi \leftarrow Red[\psi ;R;Z,M]$ is performed after the verified target $\Delta$ has been removed from R. By Proposition 3, the resulting residual theory is equivalent to the reduct obtained directly from the original theory with the remaining active minimized atoms. The additional origin map does not affect the semantics of the check; it only records how each residual proof object can be replayed from primitive clauses of $\phi$.

Example 10.

Run Algorithm 2 on the clause theory from Example 8 with candidate interpretation $M_1=\{p_1,p_2,p_3\}$ and strategy $t=MUS$. The first selected source component has target ${\Delta }_0=\left\{p_3\right\}$ and local residual theory

$${\lambda }_0=\{{\alpha }_4:p_3\vee z_1,{\alpha }_5^{\prime }:\neg z_1\}.$$

As shown in Example 9, this local obligation is certified by the original support

$${\kappa }_0=\{{\alpha }_4:p_3\vee z_1,{\alpha }_5:q_1\vee \neg z_1\}\subseteq \phi .$$

The checker records the certificate fragment $(C_3,{\kappa }_0)$, contracts $p_3$, and recomputes the residual reduct. The derived objects $U_0$, ${\Delta }_0$, and ${\lambda }_0$ are not stored in the certificate; they are recomputed from the current residual state and the selected component $C_3$. The next non-empty source component has target ${\Delta }_1=\{p_1,p_2\}$. Its local residual theory contains, for instance,

$$\{{\alpha }_1:\neg p_1\vee p_2,{\alpha }_2:p_1\vee \neg p_2,{\alpha }_3^{\prime }:p_1\}.$$

A successful MUS call returns an original support ${\kappa }_1\subseteq \phi$ whose current reduct entails $p_1\wedge p_2$. After $\{p_1,p_2\}$ is contracted, the active minimized set is empty, and the checker returns $(\mathbf{true},\mathcal{C})$, where

$$\mathcal{C}=\langle (C_3,{\kappa }_0),(C_{12},{\kappa }_1)\rangle .$$

During replay, the verifier reconstructs $U_i$, ${\Delta }_i$, and ${\lambda }_i$ from the residual state generated before checking $C_i$.

The strategy t determines only the form of the successful certificate support. In SAT, the residual support is the whole local residual theory and $\kappa$ is its origin set. In MUS, the residual support is first minimized inside the local residual theory and then mapped back to original clauses. In both cases, the recorded $\kappa$ is an original-clause support. This format avoids making the certificate depend on a particular textual presentation of intermediate reduct clauses.

Theorem 4

(Soundness and completeness). Let φ be a clause theory over $\mathcal{A}$, $P,Z\subseteq \mathcal{A}$ be disjoint atom sets, $M\vDash \phi$, and $t\in \{SAT,MUS\}$. Then Algorithm 2 on input $(\phi ,P,Z,M,t)$ returns

$$(\mathbf{true},\mathcal{C})$$

if and only if

$$M\vDash CIRC[\phi ;P;Z].$$

Equivalently, it returns

$$(\mathbf{false},\mathcal{F})$$

only if

$$M⊭CIRC[\phi ;P;Z].$$

Moreover, every successful certificate fragment ${\kappa }_i$ in $\mathcal{C}$ is a subset of the original clause theory φ whose replayed reduct certifies the corresponding local target.

Proof. 

The Boolean part of the claim follows the same chain as before. The reduct characterization reduces circumscription checking to the entailment $Red[\phi ;P;Z,M]\vDash \bigwedge M\cap P$. The source-component theorem decomposes this entailment into the local obligations generated by the checker. Proposition 6 shows that every $(\mathbf{proved},{\kappa }_i)$ returned by LocalCertify establishes the corresponding local obligation, while every $(\mathbf{refuted},I)$ is a genuine local countermodel. Hence, if all generated obligations are certified and the active set becomes empty, the global reduct entailment holds; if some obligation is refuted, the global reduct entailment fails. The final statement about ${\kappa }_i$ is exactly the origin-preservation condition in Definition 9 and Proposition 6. □

Remark 1.

The procedureLocalCertifyis not part of the definition of circumscription. It is a proof-producing mechanism for the local entailment tasks generated by the decomposition. The variants SAT and MUS differ only in the residual support from which the original-clause support κ is obtained. The preferred certificate is therefore not $\kappa \subseteq \lambda$, but $\kappa \subseteq \phi$ together with a replay condition through the current reduct and scope.

6. Experimental Evaluation

The experimental evaluation examines the implementation-level consequences of the decomposition. Since the checker receives a candidate interpretation rather than solving an unconstrained model-enumeration task, the experiments measure Boolean agreement with the global minimal-reduct characterization and the structural information produced by the checker. We report the size of the generated local obligations, the size of the supports ${\kappa }_i\subseteq \phi$, and whether the returned certificates can be replayed.

6.1. Research Questions

The evaluation addresses the following questions.

RQ1. 

Correctness. Do the decomposition-based methods return the same Boolean result as the exact global reduct baseline?

RQ2. 

Locality. How large are the local residual theories ${\lambda }_i$ compared with the current residual reduct ${\psi }_i$?

RQ3. 

Certificate compactness. How large are the origin-preserving supports ${\kappa }_i\subseteq \phi$ produced by SAT and MUS?

RQ4. 

Replayability. Can the returned certificates be independently replayed by reconstructing the corresponding local obligations?

6.2. Compared Methods

The comparison separates the semantic baseline from the two certificate-generating variants of the checker.

(i)

GlobalReduct computes

$$\psi =Red[\phi ;P;Z,M]$$

and checks the single entailment

$$\psi \vDash \bigwedge M\cap P.$$

This is the exact semantic baseline induced by Theorem 1.

(ii)

Decomp-SAT runs Algorithm 2 with $t=SAT$. Each local obligation is checked by a direct SAT call, and the support is mapped back to original clauses.

(iii)

Decomp-MUS runs Algorithm 2 with $t=MUS$. Each verified local obligation is first reduced to an unsatisfiable subtheory, and the selected residual clauses are then mapped back to their origins in $\phi$.

Thus GlobalReduct is the reference implementation for the Boolean answer. Decomp-SAT and Decomp-MUS measure the additional cost of generating local proof fragments. The two decomposition-based variants verify the same local obligations; they differ only in how much of the local residual theory is retained as an original-clause support.

6.3. Benchmark Families and Setup

The experimental instances are derived from the computational results reported for the minimal-reduct approach to propositional circumscription [11]. We use two solved benchmark families: 5445 random 3CNF instances and 462 industrial CNF instances. The experiments are therefore not intended as a new evaluation of full circumscription-model computation. Instead, they isolate the subsequent checking problem by using instances for which candidate models are already available, and then measure decomposition, local certification, and certificate replay.

The random 3CNF family tests the behavior of the checker on controlled randomly generated clause theories. The industrial CNF family tests the method on non-synthetic formulas with irregular dependency structure. For each instance, the input consists of a clause theory $\phi$, disjoint sets P and Z, and a candidate model $M\vDash \phi$.

All experiments were conducted on a machine equipped with an Intel(R) Core(TM) i7-10700F CPU @ 2.90GHz, with 8 physical cores, 16 logical cores, and 32 GB of memory, running Ubuntu 26.04. GlobalReduct, Decomp-SAT, and Decomp-MUS were executed under the same software environment. MiniSAT was used for all SAT calls, including the global entailment checks and the direct local checks in SAT. PicoMUS was used for the MUS extraction calls in MUS. Runtime is reported in milliseconds and averaged over solved instances in each benchmark family.

6.4. Measured Quantities

For each instance, we record the following quantities.

Correctness and runtime.

We record the Boolean result, runtime, timeout status, and agreement with GlobalReduct whenever the baseline terminates.

Reduct and graph structure.

For

$$\psi =Red[\phi ;P;Z,M],R=M\cap P,$$

we record

$$\left|\phi \right|,\left|\psi \right|,\left|P\right|,\left|Z\right|,\left|R\right|,\#SCC,\underset{C}{max}|lab\left(C\right)|.$$

Local obligations.

For each selected component $C_i$, we reconstruct

$$U_i={Scope}_{{\mathbb{S}}_i}\left(C_i\right),{\Delta }_i=lab\left(C_i\right)\cap R_i,{\lambda }_i={\left({\psi }_i\right)}_{U_i},$$

and record

$$|U_i|,|{\Delta }_i|,|{\lambda }_i|,|{\lambda }_i|/|{\psi }_i|.$$

Certificates.

For a successful run returning

$$\mathcal{C}=\langle (C_0,{\kappa }_0),\dots ,(C_{m-1},{\kappa }_{m-1})\rangle ,$$

we record

$$\left|\mathcal{C}\right|,\sum _{i<m}\left|{\kappa }_i\right|,{\displaystyle \frac{{\sum }_{i<m}\left|{\kappa }_i\right|}{\left|\phi \right|}},{\displaystyle \frac{{\sum }_{i<m}\left|{\kappa }_i\right|}{{\sum }_{i<m}\left|{\lambda }_i\right|}}.$$

The quantity ${\sum }_{i<m}\left|{\kappa }_i\right|$ is accumulated over all certificate fragments and counts clauses with multiplicity. Hence the same original clause may be counted more than once when it appears in different local supports.

Replay.

Each certificate fragment $(C_i,{\kappa }_i)$ is replayed by reconstructing $U_i$, ${\Delta }_i$, and ${\lambda }_i$, and checking

$${\left(Red[{\kappa }_i;R_i;Z,M]\right)}_{U_i}\cup \left\{{\beta }_i\right\}\vDash \perp ,{\beta }_i=\bigvee \neg {\Delta }_i.$$

We record replay success and replay time.

6.5. Results

We begin with the Boolean sanity check and the runtime overhead introduced by certificate generation.

Table 1. Correctness and runtime comparison.

Family	#Inst.	Global solved	SAT correct	MUS correct	Global time ms	SAT time ms	MUS time ms
Random 3CNF	5445	5445	5445	5445	0.046	16.271	157.274
Industrial CNF	462	462	462	462	29.563	34435.429	539509.732

Table 1. Correctness and runtime comparison.

Family	#Inst.	Global solved	SAT correct	MUS correct	Global time ms	SAT time ms	MUS time ms
Random 3CNF	5445	5445	5445	5445	0.046	16.271	157.274
Industrial CNF	462	462	462	462	29.563	34435.429	539509.732

The following measurements describe the sizes of the residual theories and the coarseness of their collapsed dependency graphs.

Table 2. Reduct and dependency-graph structure.

Family	Avg. $\left|\mathit{\phi }\right|$	Avg. $\left|\mathit{\psi }\right|$	Avg. $\left|\mathit{P}\right|$	Avg. $\left|\mathit{Z}\right|$	Avg. #SCC	Avg. max SCC	Avg. reduct ratio
Random 3CNF	1827.893	555.589	156.545	156.545	119.750	255.379	0.302
Industrial CNF	156871.643	37323.433	6263.712	6273.506	3263.699	10145.747	0.255

Table 2. Reduct and dependency-graph structure.

Family	Avg. $\left|\mathit{\phi }\right|$	Avg. $\left|\mathit{\psi }\right|$	Avg. $\left|\mathit{P}\right|$	Avg. $\left|\mathit{Z}\right|$	Avg. #SCC	Avg. max SCC	Avg. reduct ratio
Random 3CNF	1827.893	555.589	156.545	156.545	119.750	255.379	0.302
Industrial CNF	156871.643	37323.433	6263.712	6273.506	3263.699	10145.747	0.255

The next table measures how much of the current residual theory is involved in each source-component obligation.

Table 3. Local obligation sizes.

Family	Mode	Avg. $|{\mathit{U}}_{\mathit{i}}|$	Avg. $|{\mathit{\Delta }}_{\mathit{i}}|$	Avg. $|{\mathit{\lambda }}_{\mathit{i}}|$	Avg. $|{\mathit{\lambda }}_{\mathit{i}}|/|{\mathit{\psi }}_{\mathit{i}}|$	Max. $|{\mathit{\lambda }}_{\mathit{i}}|$
Random 3CNF	SAT	79.747	2.486	157.029	0.407	2483
Random 3CNF	MUS	79.747	2.486	157.029	0.407	2483
Industrial CNF	SAT	3312.655	8.334	10244.507	0.272	385375
Industrial CNF	MUS	3312.655	8.334	10244.507	0.272	385375

Table 3. Local obligation sizes.

Family	Mode	Avg. $|{\mathit{U}}_{\mathit{i}}|$	Avg. $|{\mathit{\Delta }}_{\mathit{i}}|$	Avg. $|{\mathit{\lambda }}_{\mathit{i}}|$	Avg. $|{\mathit{\lambda }}_{\mathit{i}}|/|{\mathit{\psi }}_{\mathit{i}}|$	Max. $|{\mathit{\lambda }}_{\mathit{i}}|$
Random 3CNF	SAT	79.747	2.486	157.029	0.407	2483
Random 3CNF	MUS	79.747	2.486	157.029	0.407	2483
Industrial CNF	SAT	3312.655	8.334	10244.507	0.272	385375
Industrial CNF	MUS	3312.655	8.334	10244.507	0.272	385375

We finally measure the size of the origin-preserving supports and the cost of checking them again during replay.

Table 4. Origin-preserving certificate quality.

Family	Mode	Avg. $\left|\mathcal{C}\right|$	Avg. ${\sum }_{\mathit{i}}\left|{\mathit{\kappa }}_{\mathit{i}}\right|$	Avg. ${\sum }_{\mathit{i}}|{\mathit{\kappa }}_{\mathit{i}}|/|\mathit{\phi }|$	Replay success (%)	Avg. replay time ms
Random 3CNF	SAT	24.757	3887.578	1.723	100.000	6.354
Random 3CNF	MUS	24.757	100.541	0.055	100.000	1.924
Industrial CNF	SAT	175.900	1802013.264	6.838	100.000	8152.697
Industrial CNF	MUS	175.900	2760.537	0.030	100.000	1835.944

Table 4. Origin-preserving certificate quality.

Family	Mode	Avg. $\left|\mathcal{C}\right|$	Avg. ${\sum }_{\mathit{i}}\left|{\mathit{\kappa }}_{\mathit{i}}\right|$	Avg. ${\sum }_{\mathit{i}}|{\mathit{\kappa }}_{\mathit{i}}|/|\mathit{\phi }|$	Replay success (%)	Avg. replay time ms
Random 3CNF	SAT	24.757	3887.578	1.723	100.000	6.354
Random 3CNF	MUS	24.757	100.541	0.055	100.000	1.924
Industrial CNF	SAT	175.900	1802013.264	6.838	100.000	8152.697
Industrial CNF	MUS	175.900	2760.537	0.030	100.000	1835.944

6.6. Discussion of Results

The results first confirm that the decomposition-based checker preserves the Boolean outcome of the global reduct test on all evaluated instances. Both Decomp-SAT and Decomp-MUS agree with GlobalReduct on all 5445 random 3CNF instances and all 462 industrial CNF instances. This agreement is the basic empirical sanity check for the implementation: the source-component traversal, residual-reduct recomputation, and the two local certification strategies preserve the semantic decision returned by the global baseline.

The structural measurements show that the minimal reduct already removes a substantial portion of the input before decomposition is applied. The average reduct ratio is $0.302$ for the random 3CNF family and $0.255$ for the industrial CNF family. Decomposition then further localizes the entailment tests: the average local-obligation ratio $|{\lambda }_i|/|{\psi }_i|$ is $0.407$ on the random 3CNF family and $0.272$ on the industrial CNF family. Thus, on average, the global reduct entailment test is replaced by obligations involving considerably smaller induced residual theories.

The targets of the local obligations are small relative to the surrounding residual theories. The average value of $|{\Delta }_i|$ is $2.486$ for the random 3CNF family and $8.334$ for the industrial CNF family. Hence each certificate fragment usually accounts for a small set of minimized atoms, even when its induced residual theory is non-trivial. This supports the intended use of the certificate as a sequence of localized proof fragments rather than as a single monolithic proof of global minimality.

The largest difference between SAT and MUS is the size of the supports. For random 3CNF instances, the accumulated support size decreases from $3887.578$ in SAT to $100.541$ in MUS. For industrial CNF instances, it decreases from $1802013.264$ to $2760.537$. Thus MUS reduces the accumulated support size by about $38.7$ times on the random 3CNF family and about $652.8$ times on the industrial CNF family. In these experiments, MUS extraction is mainly a certificate compression step: it removes redundant residual clauses before the remaining support is mapped back to the original clause theory $\phi$.

All returned certificates can be replayed in the experiments. The replay success rate is $100\%$ for both benchmark families and both local certification modes. This confirms that the certificate format

$$\mathcal{C}=\langle (C_0,{\kappa }_0),\dots ,(C_{m-1},{\kappa }_{m-1})\rangle$$

contains enough primitive information for independent verification. The objects $U_i$, ${\Delta }_i$, and ${\lambda }_i$ need not be stored in the certificate, because they are reconstructed from the residual state and the selected component $C_i$ during replay.

The runtime data should not be read as evidence of decision-speed superiority. GlobalReduct is substantially faster in the current prototype because it performs a direct global entailment check. By contrast, the decomposition variants repeatedly construct local scopes, recompute residual reducts, maintain origin maps, and produce certificate fragments. The additional cost is especially visible in MUS, where an unsatisfiable subtheory is extracted for each successful local obligation. The present implementation therefore trades runtime for locality, smaller original-clause supports, and independent replay.

The industrial CNF results also indicate a boundary of the method. Although the average local-obligation ratio is smaller than in the random 3CNF family, the maximum local residual size remains large. This means that some instances contain dependency regions whose ancestor scopes are close to global in size. In such cases, source-component decomposition naturally approaches the cost of the global reduct check. This behavior should be understood as a structural limitation of the decomposition, not as a failure of the underlying reduct characterization.

7. Discussion

The method is structure-sensitive. Raw decision time is only one part of the picture; the method also depends on whether the minimal reduct exposes a collapsed dependency graph whose source components and ancestor scopes yield useful local obligations. When this structure is present, the global residual entailment test can be replaced by a sequence of local checks, and each check can be associated with a support in the original input theory. When the residual graph is dominated by a single large strongly connected component or by large ancestor scopes, the decomposition naturally approaches the global reduct check. This is a graph-theoretic boundary of the method.

The certificate design is intentionally conservative. A local residual theory $\lambda$ is useful for computation, but it is not the best final explanation. The final certificate fragment $\kappa$ should point back to original clauses of $\phi$. This makes the certificate more stable under changes in duplicate-clause removal, clause normalization, or details of the intermediate reduct representation. It also makes proof replay conceptually clean: a verifier receives $(C_i,{\kappa }_i)$, reconstructs the residual state, scope, and target, recomputes the reduct of ${\kappa }_i$, and checks the local unsatisfiability condition.

The local certification procedure has no semantic autonomy. It does not revise the candidate model and does not define a new form of circumscription. Its role is to produce local proof objects or local countermodels for obligations generated by the decomposition theorem. The SAT variant favors direct certification, whereas the MUS variant favors smaller certificates. Both variants test the same entailment obligation.

The experiments should also be read in this light. The present prototype does not improve on GlobalReduct as a pure decision procedure. Instead, it provides additional proof structure: smaller local obligations, compact original-clause supports, and certificates that can be replayed. A single fast Boolean check and a structured certificate-generating check serve different purposes.

8. Conclusions

We developed a decomposition-based checker for propositional circumscription. The minimal reduct gives the semantic reduction from global minimality to residual entailment. On top of this reduct, the collapsed negative dependency graph decomposes the global entailment condition into source-component obligations. The checker verifies source components, contracts verified minimized atoms, recomputes residual reducts, and records certificate fragments.

The final certificate records original clauses. Instead of regarding $\kappa$ as a subset of an intermediate local residual theory $\lambda$, the checker records $\kappa$ as a subset of the original clause theory $\phi$. Replaying $\kappa$ through the same reduct and scope restriction yields a residual support sufficient to certify the local target. This keeps the certificate close to the primitive formulas of the input theory and avoids tying the explanation to a particular intermediate reduct representation.

Experiments on solved random 3CNF and industrial CNF instances, derived from the computational results of the minimal-reduct approach, show that the decomposition-based checker agrees with the global reduct baseline on all tested instances. The experiments also show that local obligations are smaller than the current residual theories on average, that MUS substantially reduces the size of the original-clause supports, and that all returned certificates can be replayed. The current prototype is slower than the direct global checker, especially when MUS extraction is used. Its empirical value lies in the additional proof structure rather than in raw decision speed.

Future work includes improving residual-reduct recomputation, adding proof logging for origin-preserving certificates, studying stronger minimization criteria for $\kappa$, and evaluating the checker on additional structured benchmark families.