IxVM kernel: canonical level normalization + FFT-cost pinning

[arthurpaulino]

Summary

Two commits on level-normalization:

1. IxVM: canonical level normalization for level_equal /
   level_leq. Replaces the recursive Level.leq mirror (two-way
   param-substitution split per Max / IMax — exponential in unresolved
   universe params) with a port of Rust's Géran canonical-form machinery
   from src/ix/kernel/level.rs::normalize_level / norm_level_eq /
   norm_level_le. level_equal and level_leq now normalize-and-compare;
   the substitution helpers (level_subst_reduce, level_has_param,
   level_any_param) are deleted.

2. Tests: pin FFT cost per kernel-check target. Adds
   expectedFftCost : Option Nat to AiurTestCase; runTestCase asserts
   the rounded Aiur.computeStats.totalFftCost matches exactly. Pins all
   41 entries in Tests/Ix/IxVM.lean::kernelCheckEntries.

Motivation

The recursive Level.leq split was exponential in the number of params and
each branch materialized freshly substituted levels. On
_private.…SInt.0.Int16.instRxcHasSize_eq the level family was 93% of the
record at 2^31 ops (level_subst_reduce 60.8M + level_leq 53.2M +
level_max 30.4M entries…), entered through Inductive's ctor-field
universe constraint (level_leq), not def-eq's level_equal.

The same algorithmic gap blocks several stdlib targets in the in-tree
ixvm test suite. Beyond the fix itself, the existing suite has no
per-target FFT-cost floor: a kernel change can silently shift cost on any
pinned constant without review.

What changed

Kernel (Ix/IxVM/Kernel/Levels.lean)

• Canonical form: path-sorted list of entries (path, const, vars) where
  path is the sorted list of param indices conditioning an imax
  chain, const the max constant contribution, vars the
  idx-sorted (param, offset) contributions.
• normalize_aux walks the level with imax-path conditioning,
  delegating IMax-shape cases to normalize_imax_dispatch.
• Phase-2 nl_subsumption_walk drops contributions dominated by another
  entry whose path is a subset. Called once at the end of
  level_normalize (with the same list as both rem and snapshot).
• nl_le / nl_eq operate on canonical forms; covers-split soundness
  fix matches level.rs.
• level_normalize is keyed on the level alone, so each distinct level
  normalizes once per run; equality / leq on canonical forms is cheap.

Tests

• Tests/Aiur/Common.lean: new expectedFftCost : Option Nat field on
  AiurTestCase. runTestCase consumes queryCounts, computes
  Aiur.computeStats, and asserts the rounded totalFftCost matches
  exactly. Adds Ix.Aiur.Statistics to the imports.
• Tests/Ix/IxVM.lean: kernelCheckNames : List String →
  kernelCheckEntries : List (String × Nat). kernelChecks now sets
  expectedFftCost := some expected per entry.

Results

Unlocked targets

Before the kernel commit these typechecks OOM'd (process killed under
14 GB ulimit). After: complete with the FFT cost reported by
lake exe check <target>.

Target	Before	After (FFT cost)
Trans.mk	OOM	2.91M
Array.append_assoc	OOM	3.94G
Vector.append	OOM	4.02G
Vector.extract_append	OOM	63.76G

No regression on previously-passing targets

8-target sample, build clean both sides:

Target	Before	After
Nat.add_comm	56.05M	56.08M
Nat.add	13.34M	13.34M
Nat.decEq	71.92M	71.92M
Nat.decLe	209.64M	209.64M
Nat.sub_le_of_le_add	567.58M	567.58M

Differences are sub-0.1%, attributable to the inlined-nl_subsumption
micro-cleanup (one fewer memoized dispatch per level_normalize call).

Pinned suite coverage

41 kernel-check constants now assert exact rounded FFT cost: the 38 prior
kernelCheckNames entries (Stdlib, IxVMPrim, IxVMInd, edge-case
prelude) plus 3 newly-unlocked targets (Trans.mk,
Array.append_assoc, Vector.append). Vector.extract_append is
deliberately omitted (too heavy for CI; verified manually).

How to update a pinned cost

If a future kernel change legitimately shifts FFT cost on a pinned
target, the test failure message contains the new value:

× ∃: FFT cost matches for Kernel check Trans.mk: expected 2911629, got 2911635

Paste the got N value back into kernelCheckEntries. No tooling
beyond lake test -- --ignored ixvm is required.

Test plan

• lake build check — clean
• lake build IxTests — clean
• lake test -- --ignored ixvm — 41 FFT-cost pins pass, no
  regressions in the rest of the suite
• lake exe check Trans.mk — 2.91 M FFT, passes
• lake exe check Vector.append — 4.02 G FFT, passes
• lake exe check Array.append_assoc — 3.94 G FFT, passes
• lake exe check Vector.extract_append — 63.76 G FFT, passes
• lake exe check Nat.add_comm — 56.08 M FFT, no regression