gdp-wired 0.1.0 → 0.3.0

package/dist/core/dsl.js

@@ -15,9 +15,9 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { interpret, loadJs } from "./machine.js";
+import { compileFunction, interpret, loadJs } from "./machine.js";
 import { check, loopObligations } from "../kernel/kernel.js";
-import { grow, proveLaws, proveStepLaws } from "../kernel/prove.js";
+import { grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
     if (!Number.isSafeInteger(v) || v < 0)
@@ -205,6 +205,16 @@ class MaybeKind extends Kind {
     }
 }
 export const maybe = (of) => new MaybeKind(of);
+let boundCounter = 0;
+// A condition at every key: only as a whole flag (`flags: ({...}) => ({covered: everyKey(k => ...)})`), the key read
+// only as a map's key. The kernel closes it (instances where it holds, a witness where it fails).
+export const everyKey = (f) => { const key = `k$${++boundCounter}`; return new Cond({ op: 'all', key, c: f(v(key)).c }); };
+// Some key where f holds, in a law or a step law's conclusion (¬∀k. ¬f(k)): proven through a witness, a term naming the
+// key, given here or found by the prover among a few candidates (kernel/prove.ts).
+export const someKey = (f, witness) => {
+    const key = `s$${++boundCounter}`;
+    return new Cond({ op: 'not', x: { op: 'all', key, c: f(v(key)).not().c, ...(witness === undefined ? {} : { witness: termOf(witness) }) } });
+};
 // A map from naturals to naturals, every cell starting at `init`. One write per map per step.
 export class MapRef {
     name;
@@ -217,12 +227,291 @@ export class MapRef {
     set(key, value) { return { map: this.name, key: termOf(key), value: termOf(value) }; }
     // key's cell plus `by` where `c` holds (the counter every cap keeps).
     bump(key, c = yes, by = 1) { return this.set(key, when(c, this.at(key).plus(by), this.at(key))); }
+    // Every key at once: the value at each key, the key read only as a map's key (Other.at(k)).
+    each(f) { const each = `k$${++boundCounter}`; return { map: this.name, each, value: termOf(f(v(each))) }; }
+    // As a set (cells 0 or 1): a member, and, as whole flags, every member of this one in another, none shared, the same.
+    has(key) { return this.at(key).atLeast(1); }
+    subsetOf(other) { return everyKey(k => this.at(k).atMost(other.at(k))); }
+    disjointFrom(other) { return everyKey(k => this.at(k).plus(other.at(k)).atMost(1)); }
+    sameAs(other) { return everyKey(k => this.at(k).eq(other.at(k))); }
+    // Over a universe of n names (keys 0 .. n − 1): every key past it holds 0 (a law, or a whole flag for a set a request
+    // carries), and the set's size, the sum of its cells there (exact, given `within`).
+    within(n) { naturalConst(n); return everyKey(k => k.atLeast(n).implies(this.at(k).eq(0))); }
+    sizeBelow(n) { naturalConst(n); return sum(0, ...Array.from({ length: n }, (_, key) => this.at(key))); }
+}
+export class ListRef {
+    name;
+    len;
+    constructor(name, len) {
+        this.name = name;
+        this.len = len;
+    }
+    at(i) { return new Term({ op: 'get', map: this.name, key: termOf(i) }); }
+    // Conditions: x at some position; each position below the next.
+    has(x) { return everyKey(k => k.lt(this.len).implies(this.at(k).ne(x))).not(); }
+    sorted() { return everyKey(k => k.plus(1).lt(this.len).implies(this.at(k).lt(this.at(k.plus(1))))); }
+    // Operations.
+    push(x, when = yes) { return { when, at: k => when_(k.eq(this.len), x, this.at(k)), len: this.len.plus(1) }; }
+    pop(when = yes) { return { when, at: k => when_(k.plus(1).eq(this.len), 0, this.at(k)), len: this.len.minus(1) }; }
+    set(i, x, when = yes) { return { when, at: k => when_(k.eq(i), x, this.at(k)), len: this.len }; }
+    insertAt(i, x, when = yes) { return { when, at: k => when_(k.lt(i), this.at(k), when_(k.eq(i), x, this.at(k.minus(1)))), len: this.len.plus(1) }; }
+    removeAt(i, when = yes) { return { when, at: k => when_(k.lt(i), this.at(k), this.at(k.plus(1))), len: this.len.minus(1) }; }
+    // The updates for the step: the first operation whose condition holds, else the list as it was.
+    apply(...ops) {
+        const each = `k$${++boundCounter}`, k = v(each);
+        const at = ops.reduceRight((acc, op) => when_(op.when, op.at(k), acc), this.at(k));
+        const len = ops.reduceRight((acc, op) => when_(op.when, op.len, acc), this.len);
+        return { [this.name]: { map: this.name, each, value: at.e }, [`${this.name}_len`]: len };
+    }
+    // Laws: nothing past the end; positions strictly increasing (so no name twice), as one law about every two keys.
+    within() { return forall(k => this.len.atMost(k).implies(this.at(k).eq(0))); }
+    increasing() { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(this.at(i).lt(this.at(j)))); }
 }
+const when_ = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) });
 // A law about every key of a map: proven at a fresh key, assumed at the keys a step reads.
-export const forall = (f) => ({ forall: f });
+// With two parameters or more, about every two keys or more: forall((i, j) => i.lt(j).implies(...)).
+export function forall(f) { return { forall: f }; }
+// The keys a law's callback names: one, or two when it takes two.
+const keysFor = (out) => [`key$${++keyCounter}`, Array.from({ length: Math.max(0, out.forall.length - 1) }, () => `key$${++keyCounter}`)];
 // For histories: `holds` (a <= b, homogeneous over sums and queries) wherever `when` (params and plain inputs) holds.
 export const relation = (holds, whenever = yes) => ({ when: whenever, holds });
+// --- quantifiers anywhere ---------------------------------------------------------------------------------------------
+// The kernel takes a condition at every key as a whole flag only (decided once per step, closed both ways). Written
+// anywhere else in a step (inside another flag, a term's if, a write, the assumption), it is named here as a flag of its
+// own, so every part downstream sees only whole flags. A per-step truth inside such a condition (another quantifier,
+// or a flag) is split out by cases: ∀k. φ(k, q) is (q ∧ ∀k. φ(k, yes)) ∨ (¬q ∧ ∀k. φ(k, no)). A quantifier that reads a
+// key bound outside it is two keys at once, which no flag is.
+const namesIn = (t) => [...JSON.stringify(t).matchAll(/"op":"var","name":"([^"]+)"/g)].map(m => m[1]);
+function swapC(c, from, to) {
+    if (c === from)
+        return to;
+    switch (c.op) {
+        case 'not': return { op: 'not', x: swapC(c.x, from, to) };
+        case 'and':
+        case 'or': return { op: c.op, xs: c.xs.map(y => swapC(y, from, to)) };
+        case 'all': return { op: 'all', key: c.key, c: swapC(c.c, from, to) };
+        case 'flag': return c;
+        case '<':
+        case '<=':
+        case '=': return { ...c, a: swapE(c.a, from, to), b: swapE(c.b, from, to) };
+    }
+}
+function swapE(e, from, to) {
+    switch (e.op) {
+        case 'var':
+        case 'const': return e;
+        case 'mul': return { ...e, a: swapE(e.a, from, to) };
+        case 'if': return { op: 'if', c: swapC(e.c, from, to), then: swapE(e.then, from, to), else: swapE(e.else, from, to) };
+        case 'get': return { ...e, key: swapE(e.key, from, to) };
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return { ...e, a: swapE(e.a, from, to), b: swapE(e.b, from, to) };
+    }
+}
+function perStep(c) {
+    switch (c.op) {
+        case 'flag':
+        case 'all': return c;
+        case 'not': return perStep(c.x);
+        case 'and':
+        case 'or':
+            for (const y of c.xs) {
+                const p = perStep(y);
+                if (p)
+                    return p;
+            }
+            return undefined;
+        case '<':
+        case '<=':
+        case '=': return perStepE(c.a) ?? perStepE(c.b);
+    }
+}
+function perStepE(e) {
+    switch (e.op) {
+        case 'var':
+        case 'const': return undefined;
+        case 'mul': return perStepE(e.a);
+        case 'if': return perStep(e.c) ?? perStepE(e.then) ?? perStepE(e.else);
+        case 'get': return perStepE(e.key);
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return perStepE(e.a) ?? perStepE(e.b);
+    }
+}
+class Hoister {
+    prefix;
+    flags = {};
+    constructor(prefix) {
+        this.prefix = prefix;
+    }
+    n = 0;
+    // c with every quantifier inside it named as a flag; `bound` the keys bound outside c.
+    cond(c, bound = []) {
+        switch (c.op) {
+            case 'all': return this.quantifier(c, bound);
+            case 'flag': return c;
+            case 'not': return { op: 'not', x: this.cond(c.x, bound) };
+            case 'and':
+            case 'or': return { op: c.op, xs: c.xs.map(y => this.cond(y, bound)) };
+            case '<':
+            case '<=':
+            case '=': return { ...c, a: this.term(c.a, bound), b: this.term(c.b, bound) };
+        }
+    }
+    term(e, bound = []) {
+        switch (e.op) {
+            case 'var':
+            case 'const': return e;
+            case 'mul': return { ...e, a: this.term(e.a, bound) };
+            case 'if': return { op: 'if', c: this.cond(e.c, bound), then: this.term(e.then, bound), else: this.term(e.else, bound) };
+            case 'get': return { ...e, key: this.term(e.key, bound) };
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod': return { ...e, a: this.term(e.a, bound), b: this.term(e.b, bound) };
+        }
+    }
+    // A quantifier as a flag (or, with per-step truths inside, a condition over flags).
+    quantifier(q, bound, name) {
+        const outer = bound.filter(key => namesIn(q).includes(key));
+        if (outer.length)
+            throw new Error(`a condition at every key reads ${outer[0]}, a key bound outside it: two keys at once are outside the kernel`);
+        const inner = perStep(q.c);
+        if (!inner) {
+            const f = name ?? `${this.prefix}${++this.n}`;
+            this.flags[f] = { op: 'all', key: q.key, c: q.c };
+            return { op: 'flag', name: f };
+        }
+        const truth = inner.op === 'flag' ? inner : this.quantifier(inner, [...bound, q.key]);
+        const split = (by) => this.quantifier({ op: 'all', key: q.key, c: swapC(q.c, inner, by) }, bound);
+        return { op: 'or', xs: [{ op: 'and', xs: [truth, split(yes.c)] }, { op: 'and', xs: [{ op: 'not', x: truth }, split(no.c)] }] };
+    }
+}
+// A machine built by hand (or by a combinator) with quantifiers inside its conditions, terms or writes: each named as a
+// flag of its own, as the builders do.
+export function nameQuantifiers(m) {
+    const hoist = new Hoister('all$'), flags = {};
+    const placed = () => { for (const [n, c] of Object.entries(hoist.flags))
+        if (!(n in flags))
+            flags[n] = c; };
+    for (const [n, c] of Object.entries(m.step.flags ?? {})) {
+        const out = c.op === 'all' ? hoist.quantifier(c, [], n) : hoist.cond(c);
+        placed();
+        if (!(n in flags))
+            flags[n] = out;
+    }
+    const state = Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [n, hoist.term(e)]));
+    const maps = Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([n, w]) => [n, 'each' in w ? { each: w.each, value: hoist.term(w.value, [w.each]) } : { key: hoist.term(w.key), value: hoist.term(w.value) }]));
+    const assume = m.assume ? hoist.cond(m.assume) : undefined;
+    placed();
+    return { ...m, step: { ...(Object.keys(flags).length ? { flags } : {}), ...(m.step.state ? { state } : {}), ...(m.step.maps ? { maps } : {}) }, ...(assume ? { assume } : {}) };
+}
+// A law or a step law's conclusion with quantifiers inside, each pulled out as the law's one key: ∀k. A ∧ ∀k. B is
+// ∀k. A ∧ B, and p ∨ ∀k. A is ∀k. p ∨ A when p doesn't read the key. One under an or beside a part that reads the key
+// is two keys at once. A quantifier under a not is some key (someKey), left for the prover's witness.
+const hasForall = (c, positive = true) => c.op === 'all' ? positive || hasForall(c.c, positive) : c.op === 'not' ? hasForall(c.x, !positive) : c.op === 'and' || c.op === 'or' ? c.xs.some(y => hasForall(y, positive)) : false;
+const hasAll = (c) => JSON.stringify(c).includes('"op":"all"');
+function prenex(c, what, key) {
+    let found = false;
+    const walk = (d, positive) => {
+        switch (d.op) {
+            case 'all':
+                if (!positive)
+                    return d;
+                found = true;
+                return walk(substKey(d.c, d.key, key), positive);
+            case 'not': return { op: 'not', x: walk(d.x, !positive) };
+            case 'and':
+            case 'or': {
+                if ((d.op === 'or') === positive && d.xs.some(y => hasForall(y, positive)) && d.xs.filter(y => hasForall(y, positive) || namesIn(y).includes(key)).length > 1)
+                    throw new Error(`${what}: a condition at every key in an or beside another part that reads a key is two keys at once`);
+                return { op: d.op, xs: d.xs.map(y => walk(y, positive)) };
+            }
+            case 'flag': return d;
+            case '<':
+            case '<=':
+            case '=':
+                if (hasAll(d))
+                    throw new Error(`${what}: a condition at every key inside a term is a flag of the rule`);
+                return d;
+        }
+    };
+    const out = walk(c, true);
+    return found ? out : undefined;
+}
+const substKey = (c, from, to) => JSON.parse(JSON.stringify(c).replaceAll(`"op":"var","name":"${from}"`, `"op":"var","name":"${to}"`));
+export const fn = (arity, js, opts = {}) => {
+    if (!Number.isInteger(arity) || arity < 1)
+        throw new Error('a function takes one argument or more');
+    return { arity, js, ...opts };
+};
+// x / c and x mod c, rounded down, for a constant c >= 1: each with its two facts (c·q <= x < c·q + c), which Lean's omega
+// proves of `x / c`.
+export const divBy = (c) => {
+    if (!Number.isSafeInteger(c) || c < 1)
+        throw new RangeError('divBy takes a whole number at least 1');
+    return fn(1, `x => Math.floor(x / ${c})`, { lean: `fun x => x / ${c}`, facts: f => ({
+            [`${c}·q(x) <= x`]: forall(x => f(x).times(c).atMost(x)),
+            [`x < ${c}·q(x) + ${c}`]: forall(x => x.lt(f(x).times(c).plus(c))),
+        }) });
+};
+export const modBy = (c) => {
+    if (!Number.isSafeInteger(c) || c < 1)
+        throw new RangeError('modBy takes a whole number at least 1');
+    // x mod c is below c, and x less it is a multiple of c: x ∸ r = c·q for the q that divBy(c) gives; as facts about r
+    // alone, r <= x, r < c, and r(x + c) = r(x).
+    return fn(1, `x => x % ${c}`, { lean: `fun x => x % ${c}`, facts: f => ({
+            [`r(x) < ${c}`]: forall(x => f(x).lt(c)),
+            [`r(x) <= x`]: forall(x => f(x).atMost(x)),
+            [`r(x + ${c}) = r(x)`]: forall(x => f(x.plus(c)).eq(f(x))),
+        }) });
+};
+const pairE = (a, b) => ({ op: 'if', c: { op: '<', a, b }, then: { op: 'add', a: { op: 'prod', a: b, b }, b: a }, else: { op: 'add', a: { op: 'add', a: { op: 'prod', a, b: a }, b: a }, b } });
+const argsKey = (args) => args.slice(1).reduce(pairE, args[0]);
+// A function's JavaScript as one function of its key: its arguments unpaired (left-nested, as argsKey pairs them).
+const fnSource = (name, d) => {
+    const src = typeof d.js === 'string' ? d.js : String(d.js);
+    let f;
+    try {
+        f = compileFunction([], `return (${src})`)();
+        f(...Array.from({ length: d.arity }, () => 0));
+    }
+    catch (e) {
+        throw new Error(`function ${name}: its js must be a function of its arguments that reads nothing else (${e.message})`);
+    }
+    if (d.arity === 1)
+        return src;
+    return `k => { const u = z => { const s = Math.floor(Math.sqrt(z)); return z - s * s < s ? [z - s * s, s] : [s, z - s * s - s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return (${src})(...a); }`;
+};
+const fnTerm = (name, d) => (...args) => {
+    if (args.length !== d.arity)
+        throw new Error(`function ${name} takes ${d.arity} argument${d.arity === 1 ? '' : 's'}`);
+    return new Term({ op: 'get', map: name, key: argsKey(args.map(termOf)) });
+};
 let keyCounter = 0;
+// A k-step law's later requests are built over marked names (j:name, which no rule can declare: ':' is reserved); the
+// kernel reads them as name@j.
+const markedName = (name) => { const m = /^(\d+):(.*)$/.exec(name); return m ? `${m[2]}@${m[1]}` : name; };
+const markedE = (e) => {
+    switch (e.op) {
+        case 'var': return { op: 'var', name: markedName(e.name) };
+        case 'const': return e;
+        case 'mul': return { ...e, a: markedE(e.a) };
+        case 'if': return { op: 'if', c: marked(e.c), then: markedE(e.then), else: markedE(e.else) };
+        case 'get': return { op: 'get', map: e.map, key: markedE(e.key) };
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return { ...e, a: markedE(e.a), b: markedE(e.b) };
+    }
+};
+const marked = (c) => c.op === 'flag' ? c : c.op === 'all' ? { op: 'all', key: c.key, c: marked(c.c) } : c.op === 'not' ? { op: 'not', x: marked(c.x) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(marked) } : { ...c, a: markedE(c.a), b: markedE(c.b) };
 // P params, I inputs, S state, M maps, F flags, R a history's record, Su its sums, Q its queries: each a record of the
 // values the builders hand out, grown by each call.
 export class Rule {
@@ -239,6 +528,18 @@ export class Rule {
         return this.with({ state: [...this.spec.state, ...Object.entries(init)] });
     }
     maps(init) { return this.with({ maps: [...this.spec.maps, ...Object.entries(init)] }); }
+    // Lists, each empty at the start: a map of positions and its length <name>_len (ListRef).
+    lists(...names) {
+        return this.with({ maps: [...this.spec.maps, ...names.map(n => [n, 0])], state: [...this.spec.state, ...names.map(n => [`${n}_len`, 0])], lists: [...(this.spec.lists ?? []), ...names] });
+    }
+    // Functions defined outside the rule (fn, divBy, modBy), read like params that take arguments: f(x).
+    fns(defs) {
+        return this.with({ fns: [...(this.spec.fns ?? []), ...Object.entries(defs)] });
+    }
+    // What is given about the functions (with their own facts): laws over the params and functions, each by name.
+    facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
+    // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
+    carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
     // Named conditions of the step, decided once per step before it; each call's flags may read the earlier calls'. A flag
     // named again replaces the earlier definition in place (what a variant needs: one call, the step unchanged); the new
     // definition may read only the flags defined before the original's place, as the kernel checks.
@@ -270,12 +571,15 @@ export class Rule {
     // (the kernel proves it adds nothing to any query).
     prune(order, after) { return this.with({ prune: { order, after: after } }); }
     // A law about the params, the state, the maps and the sums (not a request): `forall` for every key of a map.
-    law(name, f) {
-        const out = f(this.env({ flags: false, inputs: false, queries: false }));
-        if (out instanceof Cond)
-            return { name, holds: out.c };
+    law(name, f) { return this.lawOf(name, f(this.env({ flags: false, inputs: false, queries: false }))); }
+    lawOf(name, out) {
         const key = `key$${++keyCounter}`;
-        return { name, forall: key, holds: out.forall(v(key)).c };
+        if (out instanceof Cond) {
+            const p = prenex(out.c, `law ${name}`, key);
+            return p ? { name, forall: key, holds: p } : { name, holds: out.c };
+        }
+        const [k1, more] = keysFor(out), holds = out.forall(v(k1), ...more.map(v)).c;
+        return more.length ? { name, forall: k1, keys: more, holds } : { name, forall: k1, holds: prenex(holds, `law ${name}`, k1) ?? holds };
     }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
     // the request, state, maps, flags, sums, queries) to the state, maps and sums after it. `when` narrows the requests.
@@ -289,11 +593,67 @@ export class Rule {
             after[n] = v(`${n}'`);
         for (const [n, init] of this.spec.maps)
             after[n] = new MapRef(`${n}'`, init);
+        for (const n of this.spec.lists ?? [])
+            after[n] = new ListRef(`${n}'`, v(`${n}_len'`));
         const out = then(env, after), w = when ? { when: when(env).c } : {};
-        if (out instanceof Cond)
-            return { name, then: out.c, ...w };
         const key = `key$${++keyCounter}`;
-        return { name, forall: key, then: out.forall(v(key)).c, ...w };
+        if (out instanceof Cond) {
+            const p = prenex(out.c, `step law ${name}`, key);
+            return p ? { name, forall: key, then: p, ...w } : { name, then: out.c, ...w };
+        }
+        const [k1, more] = keysFor(out), c = out.forall(v(k1), ...more.map(v)).c;
+        return more.length ? { name, forall: k1, keys: more, then: c, ...w } : { name, forall: k1, then: prenex(c, `step law ${name}`, k1) ?? c, ...w };
+    }
+    // A law about k steps in a row (k from 2 to 16): `then(first, last, requests)` relates what the first step reads to the
+    // state, maps and sums after the last, with each step's request and queries (requests[0] is the first's); `when(before,
+    // j)` narrows the j-th step's request (j from 0), read at the state that step starts from.
+    //   meter.stepsLaw('two requests spend at most 2m', 2, ({spent, m}, after) => after.spent.atMost(spent.plus(m).plus(m)))
+    stepsLaw(name, k, then, when) {
+        const env = this.env();
+        const after = {};
+        for (const [n] of this.spec.state)
+            after[n] = v(`${n}'`);
+        for (const [n] of this.spec.sums)
+            after[n] = v(`${n}'`);
+        for (const [n, init] of this.spec.maps)
+            after[n] = new MapRef(`${n}'`, init);
+        for (const n of this.spec.lists ?? [])
+            after[n] = new ListRef(`${n}'`, v(`${n}_len'`));
+        // The j-th request's values over marked names, renamed to the kernel's input@j once built.
+        const mark = (j) => `${j}:`;
+        const requests = Array.from({ length: k }, (_, j) => {
+            if (j === 0)
+                return Object.fromEntries([...this.spec.inputs.map(([n]) => n), ...this.spec.queries.map(([n]) => n)].map(n => [n, env[n]]));
+            return Object.fromEntries([...this.spec.inputs.map(([n, kind]) => [n, kind.value(n, mark(j + 1))]), ...this.spec.queries.map(([n]) => [n, v(`${mark(j + 1)}${n}`)])]);
+        });
+        const out = then(env, after, requests);
+        const whens = when ? Array.from({ length: k }, (_, j) => when(env, j)) : [];
+        while (whens.length && whens.at(-1) === undefined)
+            whens.pop();
+        const w = whens.length ? { when: whens.map(c => (c ?? lit(0).atMost(0)).c) } : {};
+        const key = `key$${++keyCounter}`;
+        if (out instanceof Cond) {
+            const p = prenex(out.c, `step law ${name}`, key);
+            return p ? { name, steps: k, forall: key, then: marked(p), ...w } : { name, steps: k, then: marked(out.c), ...w };
+        }
+        const [k1, more] = keysFor(out), c = out.forall(v(k1), ...more.map(v)).c;
+        return more.length ? { name, steps: k, forall: k1, keys: more, then: marked(c), ...w } : { name, steps: k, forall: k1, then: marked(prenex(c, `step law ${name}`, k1) ?? c), ...w };
+    }
+    // "Whenever `from` holds, `to` holds later", in every run that takes each helpful request infinitely often: proven by
+    // a rank (a natural over the state and params, or several compared in order) that no step raises while `from` holds
+    // and `to` doesn't, except by reaching `to`, and that each helpful request lowers (or it reaches `to`). A helpful
+    // request names some inputs by terms over the state and params, the rest left free; with several, each comes with the
+    // region where it helps (`when`), some region always holds, and a step that keeps the rank keeps its region.
+    //   queue.leadsTo('every ticket is served', {from: ({t, next, served}) => t.lt(next).and(served.atMost(t)), to: ({t, served}) => served.gt(t),
+    //     rank: ({t, served}) => t.plus(1).minus(served), helpful: () => ({op: 1})})
+    //   batches.leadsTo('every batch is done', {from: () => yes, to: ({waiting, items}) => waiting.eq(0).and(items.eq(0)),
+    //     rank: ({waiting, items}) => [waiting, items], helpful: [{when: ({items}) => items.gt(0), request: () => ({op: 1})}, {when: ({items}) => items.eq(0), request: () => ({op: 0})}]})
+    leadsTo(name, spec) {
+        const env = this.env({ flags: false, inputs: false, queries: false });
+        const req = (f) => Object.fromEntries(Object.entries(f(env)).map(([n, t]) => [n, termOf(t)]));
+        const r = spec.rank(env), rank = Array.isArray(r) ? r.map(termOf) : termOf(r);
+        const base = { name, from: spec.from(env).c, to: spec.to(env).c, rank };
+        return typeof spec.helpful === 'function' ? { ...base, request: req(spec.helpful) } : { ...base, helpful: spec.helpful.map(h => ({ ...(h.when ? { when: h.when(env).c } : {}), request: req(h.request) })) };
     }
     // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state.
     decide(name, given, then) {
@@ -313,14 +673,21 @@ export class Rule {
         const out = {};
         for (const [n, k] of this.spec.params)
             out[n] = k.value(n);
-        if (parts.inputs !== false)
+        for (const [n, d] of this.spec.fns ?? [])
+            out[n] = fnTerm(n, d);
+        if (parts.inputs !== false) {
             for (const [n, k] of this.spec.inputs)
                 out[n] = k.value(n);
+            for (const n of this.spec.carried ?? [])
+                out[n] = new MapRef(n, 0);
+        }
         if (parts.state !== false) {
             for (const [n] of this.spec.state)
                 out[n] = v(n);
             for (const [n, init] of this.spec.maps)
                 out[n] = new MapRef(n, init);
+            for (const n of this.spec.lists ?? [])
+                out[n] = new ListRef(n, v(`${n}_len`));
             for (const [n] of this.spec.sums)
                 out[n] = v(n);
         }
@@ -339,12 +706,23 @@ export class Rule {
         const inputs = [...s.inputs.flatMap(([n, k]) => k.vars(n)), ...queries];
         const pEnv = this.env({ inputs: false, state: false, flags: false, queries: false });
         const env = this.env({ flags: false });
-        const flags = {};
+        const declared = {};
         for (const f of s.flags)
             for (const [n, c] of Object.entries(f(env))) {
-                flags[n] = c.c;
+                declared[n] = c.c;
                 env[n] = new Cond({ op: 'flag', name: n });
             } // a name again: replaced in place
+        // Quantifiers anywhere, named as flags: each placed before the flag that reads it.
+        const hoist = new Hoister('all$'), flags = {};
+        const placed = () => { for (const [n, c] of Object.entries(hoist.flags))
+            if (!(n in flags))
+                flags[n] = c; };
+        for (const [n, c] of Object.entries(declared)) {
+            const out = c.op === 'all' ? hoist.quantifier(c, [], n) : hoist.cond(c);
+            placed();
+            if (!(n in flags))
+                flags[n] = out;
+        }
         const updates = s.step?.(env) ?? {};
         const state = {}, maps = {};
         for (const [n, u] of Object.entries(updates)) {
@@ -353,20 +731,30 @@ export class Rule {
             if (typeof u === 'object' && 'map' in u) {
                 if (u.map !== n)
                     throw new Error(`${s.name}: the step writes map ${u.map} under the name ${n}`);
-                maps[n] = { key: u.key, value: u.value };
+                maps[n] = 'each' in u ? { each: u.each, value: hoist.term(u.value, [u.each]) } : { key: hoist.term(u.key), value: hoist.term(u.value) };
             }
             else
-                state[n] = termOf(u);
+                state[n] = hoist.term(termOf(u));
         }
         const pre = [...this.kindAssumptions('params'), ...s.pre.map(f => f(pEnv).c)];
-        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => f(env).c)];
+        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => hoist.cond(f(env).c))];
+        placed();
+        // Functions, and their facts: each function's own (named after it), then the rule's.
+        const fns = Object.fromEntries((s.fns ?? []).map(([n, d]) => [n, { js: fnSource(n, d), ...(d.lean ? { lean: d.lean } : {}) }]));
+        const facts = [
+            ...(s.fns ?? []).flatMap(([n, d]) => Object.entries(d.facts?.(fnTerm(n, d)) ?? {}).map(([name, f]) => this.lawOf(`${n}: ${name}`, f))),
+            ...(s.facts ?? []).flatMap(f => Object.entries(f(pEnv)).map(([name, out]) => this.lawOf(name, out))),
+        ];
         const m = {
             name: s.name, params, inputs,
             state: Object.fromEntries(s.state.map(([n, init]) => [n, typeof init === 'number' ? termOf(init) : termOf(init(pEnv))])),
             ...(s.maps.length ? { maps: Object.fromEntries(s.maps) } : {}),
+            ...(s.carried?.length ? { inputMaps: s.carried } : {}),
             step: { ...(Object.keys(flags).length ? { flags } : {}), ...(Object.keys(state).length ? { state } : {}), ...(Object.keys(maps).length ? { maps } : {}) },
             ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}),
             ...(assume.length ? { assume: assume.length === 1 ? assume[0] : { op: 'and', xs: assume } } : {}),
+            ...(Object.keys(fns).length ? { fns } : {}),
+            ...(facts.length ? { facts } : {}),
         };
         if (s.record) {
             const kinds = new Map(s.inputs);
@@ -390,10 +778,23 @@ export class Rule {
     // --- running it -----------------------------------------------------------------------------------------------------
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
-    encodeInput(values) { return encode(this.spec.inputs, values); }
+    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    encodeInput(values) {
+        const out = encode(this.spec.inputs, values);
+        for (const n of this.spec.carried ?? []) {
+            const given = values[n];
+            out[n] = given instanceof Map ? new Map(given) : new Map([...given].map(key => [key, 1]));
+        }
+        return out;
+    }
     // Random params and inputs that meet their kinds (not the user's `pre` or `assume`, which a caller checks).
     randomParams(rand, bound) { return Object.assign({}, ...this.spec.params.map(([n, k]) => k.random(n, rand, bound))); }
-    randomInput(rand, bound) { return Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound))); }
+    randomInput(rand, bound) {
+        const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
+        for (const n of this.spec.carried ?? [])
+            out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
+        return out;
+    }
     // The prune order's variable, if the history is pruned (a runtime must send it nondecreasing).
     get orderedBy() { return this.spec.prune ? new Map(this.spec.inputs).get(this.spec.prune.order).vars(this.spec.prune.order)[0] : undefined; }
     interpreter() { return interpret(this.machine); }
@@ -474,5 +875,9 @@ export function proveSteps(r, laws, stepLaws) {
     const out = proveStepLaws(r.machine, laws, stepLaws);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}) } : {}) };
 }
+export function proveLeadsTo(r, laws, l) {
+    const out = proveLiveness(r.machine, laws, l);
+    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}) } : {}) };
+}
 export const proveDecision = (d) => goalsVerdict([d.goal]);
 export const proveLoop = (l, laws) => goalsVerdict(loopObligations(l.loop, laws, l.rankTerms));

package/dist/core/machine.d.ts

@@ -43,6 +43,11 @@ export type C = {
 } | {
     op: 'flag';
     name: string;
+} | {
+    op: 'all';
+    key: string;
+    c: C;
+    witness?: E;
 };
 export type Machine = {
     name: string;
@@ -50,17 +55,21 @@ export type Machine = {
     inputs: string[];
     state: Record<string, E>;
     maps?: Record<string, number>;
+    inputMaps?: string[];
     step: {
         flags?: Record<string, C>;
         state?: Record<string, E>;
-        maps?: Record<string, {
-            key: E;
-            value: E;
-        }>;
+        maps?: Record<string, MapUpdate>;
     };
     pre?: C;
     assume?: C;
     history?: History;
+    fns?: Record<string, Fn>;
+    facts?: Law[];
+};
+export type Fn = {
+    js: string;
+    lean?: string;
 };
 export type History = {
     keep: C;
@@ -76,10 +85,24 @@ export type History = {
         after: E;
     };
 };
+export type MapUpdate = {
+    key: E;
+    value: E;
+} | {
+    each: string;
+    value: E;
+};
+export declare const pointWrite: (w: MapUpdate, where: string) => {
+    key: E;
+    value: E;
+};
+export declare const noQuantifier: (where: string) => never;
 export type Law = {
     name: string;
     holds: C;
     forall?: string;
+    keys?: string[];
+    stated?: C;
 };
 export { unreachable } from '../kernel/kernel.js';
 export declare const x: (name: string) => E;
@@ -102,17 +125,22 @@ export declare const bit: (name: string) => C;
 export type State = {
     scalars: Record<string, number>;
     maps: Record<string, Map<number, number>>;
+    defaults?: Record<string, number>;
     history?: Env[];
     last?: number;
 };
 type Env = Record<string, number>;
+export type Request = Record<string, number | ReadonlyMap<number, number>>;
 export declare const naturalIn: (v: unknown, what: string) => number;
 export declare function evalE(e: E, env: Env, st: State, m: Machine): number;
+export declare const fnValue: (fn: Fn, key: number) => number;
 export declare function evalC(c: C, env: Env, st: State, m: Machine): boolean;
+export declare function carriedView(m: Machine, st: State, input: Request, rename?: (map: string) => string): State;
+export declare const numbersOf: (input: Request) => Record<string, number>;
 export declare function interpret(m: Machine): {
     init: (params: Env) => State;
-    queries: (params: Env, st: State, input: Env) => Env;
-    step: (params: Env, st: State, input: Env) => State;
+    queries: (params: Env, st: State, input: Request) => Env;
+    step: (params: Env, given: State, input: Request) => State;
 };
 export declare function compileJs(m: Machine): string;
 export declare function compileFunction<F>(params: string[], body: string): F;