pub(super) fn with_temporary_model(model: Model, search_order: Option<Vec<Name>>) -> Model {
/// A generator model shares the comprehension's own symbol table, and both building and rewriting
/// it add declarations -- auxiliaries from flattening, dummy variables standing in for non-local
/// fragments. Left in the comprehension's scope they reappear in the *next* model built from that
/// scope, as finds with nothing constraining them (and sometimes with domains that only made sense
/// heuristic, and for Minion rather than the outer model's solver. The rewritten model is passed
/// directly to Minion, so inheriting (for example) Z3 array/LIA applicability would produce a model
/// `symbolic_guards` are the guards held back by [`split_symbolic_guards`]. They are instantiated
/// element, a guard that becomes true is discharged, and one that stays symbolic wraps the element
/// A comprehension is a leaf of `Expression`'s traversal, so a nested one keeps a scope of its own
/// Such a domain only resolves while the bindings for this assignment are in force, so the nested
/// Returns `Ok(None)` when a guard is false (the element is skipped), otherwise the guards that
/// Keeps only the quantified assignments of a solver solution, discarding auxiliaries and locals.
/// A quantified variable with an abstract domain is branched on through its representation, so the
/// solver reports its representation variables rather than the variable itself. Those are lifted
/// back into one abstract value with [`try_up`], giving a value that can be substituted into the
/// Applies constant folding and deep partial evaluation (including boolean `x = true` lowering in
/// the `Eq` arm), and lowers constant in-bounds `MatrixComponents` [`Expression::UnsafeIndex`] nodes
/// using the same oracle as `unsafe_const_index_matrix_components`, so ground tautologies and ground
/// When a source comprehension already has a guard that filters out dummy/out-of-domain values,
pub(super) fn strip_guarded_safe_index_conditions(expr: Expression) -> Option<Expression> {
/// Declarations are shared, so the guard also restores the representations they carried. Rewriting
/// declaration; left there, the next temporary model built from the same comprehension scope would
/// start from a variable already claiming to be represented, while its representation variables
/// belong to the previous model and constrain nothing here -- so the solver is free to assign them
/// anything, and every such assignment comes back as another copy of the same expanded element.