gdp-wired 0.1.0 → 0.3.0

package/dist/kernel/kernel.js

@@ -106,6 +106,7 @@ function comparison(c, path) {
 export function truth(c, path) {
     switch (c.op) {
         case 'flag': throw new Error('flags are inlined before the kernel sees them');
+        case 'all': return undefined; // closed before a goal is checked; opaque here, so it gives a leaf nothing
         case 'not': {
             const t = truth(c.x, path);
             return t === undefined ? undefined : !t;
@@ -131,6 +132,7 @@ export function truth(c, path) {
 export function facts(c, path, positive = true) {
     switch (c.op) {
         case 'flag': throw new Error('flags are inlined before the kernel sees them');
+        case 'all': return [];
         case 'not': return facts(c.x, path, !positive);
         case 'and':
         case 'or': {
@@ -234,8 +236,8 @@ function natural(e) {
         default: return unreachable(e);
     }
 }
-const naturalC = (c) => c.op === 'flag' ? true : c.op === 'not' ? naturalC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.every(naturalC) : natural(c.a) && natural(c.b);
-function substE(e, s) {
+const naturalC = (c) => c.op === 'flag' ? true : c.op === 'all' ? naturalC(c.c) : c.op === 'not' ? naturalC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.every(naturalC) : natural(c.a) && natural(c.b);
+export function substE(e, s) {
     switch (e.op) {
         case 'var': return s.vars[e.name] ?? e;
         case 'const': return e;
@@ -262,6 +264,10 @@ export function substC(c, s) {
     }
     if (c.op === 'not')
         return { op: 'not', x: substC(c.x, s) };
+    if (c.op === 'all') {
+        const { [c.key]: _bound, ...vars } = s.vars;
+        return { op: 'all', key: c.key, c: substC(c.c, { ...s, vars }) };
+    }
     if (c.op === 'and' || c.op === 'or')
         return { op: c.op, xs: c.xs.map(y => substC(y, s)) };
     return { ...c, a: substE(c.a, s), b: substE(c.b, s) };
@@ -274,6 +280,83 @@ const preOf = (o) => {
         throw new Error('a precondition reads only the params');
     return o.pre ? [o.pre] : [];
 };
+const identity = { vars: {}, maps: {}, flags: {} };
+const from = (at = identity) => ({ hyps: [], at });
+// Conditions that hold where the run is.
+const holds = (r, cs) => ({ hyps: [...r.hyps, ...cs.map(c => substC(c, r.at))], at: r.at });
+// Names read where the run is: inputs named for this step (a request's terms, or fresh names for a later step), and the
+// maps a request carries, renamed for a later step.
+const reading = (r, vars, maps = {}) => ({ hyps: r.hyps, at: { ...r.at, vars: { ...r.at.vars, ...vars },
+        maps: { ...r.at.maps, ...Object.fromEntries(Object.entries(maps).map(([map, name]) => [map, (key) => ({ op: 'get', map: name, key })])) } } });
+// One step: each name the update sets is its term read where the run is; a map read after it is the written value at
+// the written key, and what the map held before elsewhere (or, written at every key, its value at the key read).
+const step = (r, u) => {
+    const at = r.at, before = (map, key) => (at.maps[map] ? at.maps[map](key) : { op: 'get', map, key });
+    return { hyps: r.hyps, at: {
+            vars: { ...at.vars, ...Object.fromEntries(Object.entries(u.vars).map(([n, e]) => [n, substE(e, at)])) },
+            maps: { ...at.maps, ...Object.fromEntries(Object.entries(u.maps).map(([map, w]) => [map, 'each' in w
+                        ? (key) => substE(w.value, { ...at, vars: { ...at.vars, [w.each]: key } })
+                        : (key) => ({ op: 'if', c: { op: '=', a: key, b: substE(w.key, at) }, then: substE(w.value, at), else: before(map, key) })])) },
+            flags: at.flags,
+        } };
+};
+// The conclusion read at the run's end: plain names at the last frame.
+const atEnd = (r, c) => substC(c, r.at);
+// The conclusion read across the run: plain names at the first frame, primed names (s', and M'[k] as a read of the map
+// named M') at the last; the first step's inputs as it read them, and its flags, decided where it was taken.
+const across = (r, c, state, maps, first) => substC(c, {
+    vars: { ...first.inputs, ...Object.fromEntries(state.map(n => [`${n}'`, r.at.vars[n] ?? { op: 'var', name: n }])) },
+    maps: Object.fromEntries(maps.map(map => [`${map}'`, (key) => (r.at.maps[map] ? r.at.maps[map](key) : { op: 'get', map, key })])),
+    flags: first.flags,
+});
+const goal = (name, r, conclusion) => ({ name, hyps: [...r.hyps, { op: 'not', x: conclusion }] });
+// A machine's flags as its terms read them (decided before the step, over the frame it starts from): a plain flag its
+// condition (through the flags before it), a quantified flag (one whose condition holds at every key) its 0/1 variable
+// ?f, which `closing` ties to the condition.
+const flagsOf = (m) => {
+    const out = {};
+    for (const [f, c] of Object.entries(m.step.flags ?? {}))
+        out[f] = c.op === 'all' ? { op: '=', a: { op: 'var', name: `?${f}` }, b: { op: 'const', value: 1 } } : substC(c, { vars: {}, maps: {}, flags: out });
+    return out;
+};
+const quantified = (m) => Object.entries(m.step.flags ?? {}).filter((e) => e[1].op === 'all');
+// A machine's step as an update, its flags inlined.
+const updateOf = (m) => {
+    const flags = { vars: {}, maps: {}, flags: flagsOf(m) };
+    return {
+        vars: Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [n, substE(e, flags)])),
+        maps: Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([map, w]) => [map, 'each' in w ? { each: w.each, value: substE(w.value, flags) } : { key: substE(w.key, flags), value: substE(w.value, flags) }])),
+    };
+};
+const inlineFlags = (m, c) => substC(c, { vars: {}, maps: {}, flags: flagsOf(m) });
+// A quantified flag ?f, closed: it is 0 or 1; where it is 1, its condition holds at each key the proof names (instances
+// under ?f); where it is 0, the condition fails at a fresh witness w?f. A real step decides ?f by the condition, and if
+// that fails some key fails it, so these hold of every real step: a goal that refutes them refutes the machine.
+const closing = (m, instances) => quantified(m).flatMap(([f, q]) => {
+    const v = { op: 'var', name: `?${f}` }, zero = { op: 'const', value: 0 }, one = { op: 'const', value: 1 };
+    const body = (key) => substC(q.c, { vars: { [q.key]: key }, maps: {}, flags: flagsOf(m) });
+    return [{ op: '<=', a: v, b: one }, ...(instances[`?${f}`] ?? []).map((key) => ({ op: 'or', xs: [{ op: '=', a: v, b: zero }, body(key)] })),
+        { op: 'or', xs: [{ op: '=', a: v, b: one }, { op: 'not', x: body({ op: 'var', name: `w?${f}` }) }] }];
+});
+// The names a later step (j >= 2) reads its request by: inputs, quantified flags and their witnesses, and carried maps.
+const laterNames = (m, j) => ({
+    vars: Object.fromEntries([...m.inputs, ...quantified(m).flatMap(([f]) => [`?${f}`, `w?${f}`])].map(name => [name, { op: 'var', name: `${name}@${j}` }])),
+    maps: Object.fromEntries((m.inputMaps ?? []).map(map => [map, `${map}@${j}`])),
+});
+// The laws assumed where the run is: each plain law, and each every-key law at the keys the proof names.
+const assumed = (laws, instances) => laws.flatMap(l => {
+    const keys = instances[l.name] ?? [];
+    if (l.keys?.length) {
+        const names = [l.forall, ...l.keys], n = names.length;
+        return Array.from({ length: Math.floor(keys.length / n) }, (_, t) => substC(l.holds, { vars: Object.fromEntries(names.map((name, i) => [name, keys[t * n + i]])), maps: {}, flags: {} }));
+    }
+    return l.forall ? keys.map(key => substC(l.holds, { vars: { [l.forall]: key }, maps: {}, flags: {} })) : [l.holds];
+});
+// The facts about the functions, at the keys the proof names: as they are (they read the params and functions alone, so
+// any frame reads them alike).
+const given = (m, r, instances) => ({ hyps: [...r.hyps, ...assumed(m.facts ?? [], instances)], at: r.at });
+// The start: the state's start values over the params, every map cell its constant.
+const startOf = (m) => ({ vars: { ...m.state }, maps: Object.fromEntries(Object.entries(m.maps ?? {}).map(([map, c]) => [map, () => ({ op: 'const', value: c })])), flags: {} });
 function reads(t, out = { vars: new Set(), maps: new Set(), flags: new Set() }) {
     switch (t.op) {
         case 'var':
@@ -287,6 +370,14 @@ function reads(t, out = { vars: new Set(), maps: new Set(), flags: new Set() })
         case 'flag':
             out.flags.add(t.name);
             break;
+        case 'all': {
+            const inner = reads(t.c);
+            inner.vars.delete(t.key);
+            for (const k of ['vars', 'maps', 'flags'])
+                for (const name of inner[k])
+                    out[k].add(name);
+            break;
+        }
         case 'not':
             reads(t.x, out);
             break;
@@ -345,10 +436,10 @@ const distinct = (what, names) => { const seen = new Set(); for (const name of n
 // step reads params, inputs and the state before it; a flag reads the flags declared before it; a start value reads the
 // params; a law reads the params, the state, the maps and its own key.
 export function scope(m, laws = []) {
-    const state = Object.keys(m.state), maps = Object.keys(m.maps ?? {}), flags = Object.keys(m.step.flags ?? {});
+    const state = Object.keys(m.state), maps = Object.keys(m.maps ?? {}), flags = Object.keys(m.step.flags ?? {}), carried = m.inputMaps ?? [], fns = Object.keys(m.fns ?? {});
     const names = [...m.params, ...m.inputs, ...state];
-    distinct(m.name, [...names, ...maps]);
-    for (const name of [...names, ...maps, ...flags])
+    distinct(m.name, [...names, ...maps, ...carried, ...fns]);
+    for (const name of [...names, ...maps, ...carried, ...fns, ...flags])
         plainName(m.name, name);
     for (const name of Object.keys(m.step.state ?? {}))
         if (!state.includes(name))
@@ -356,19 +447,168 @@ export function scope(m, laws = []) {
     for (const map of Object.keys(m.step.maps ?? {}))
         if (!maps.includes(map))
             throw new Error(`${m.name}'s step writes the map ${map}, which it doesn't declare`);
+    // The step reads the maps a request carries too. A key bound by a quantified flag or a write at every key is new and
+    // read only as a map's key (so every key the maps hold nothing at reads alike); a quantifier is a whole flag, nowhere
+    // else.
+    const readable = [...maps, ...carried, ...fns];
+    const bound = (what, key, t) => {
+        plainName(what, key);
+        if ([...names, ...readable, ...flags].includes(key))
+            throw new Error(`${what}: the key ${key} is already a name of ${m.name}`);
+        keyOnly(what, t, key, fns);
+    };
     inScope(`${m.name}'s start`, Object.values(m.state), m.params);
-    Object.values(m.step.flags ?? {}).forEach((c, i) => inScope(`${m.name}'s flag ${flags[i]}`, [c], names, maps, flags.slice(0, i)));
-    inScope(`${m.name}'s step`, [...Object.values(m.step.state ?? {}), ...Object.values(m.step.maps ?? {}).flatMap(w => [w.key, w.value])], names, maps, flags);
-    if (m.assume)
-        inScope(`${m.name}'s assumption`, [m.assume], names, maps, flags);
+    flags.forEach((f, i) => {
+        const c = m.step.flags[f], what = `${m.name}'s flag ${f}`;
+        // A quantified flag's body reads no flag (the twin decides quantified flags before the plain ones).
+        if (c.op === 'all') {
+            bound(what, c.key, c.c);
+            unquantified(what, c.c);
+            inScope(what, [c.c], [...names, c.key], readable, []);
+        }
+        else {
+            unquantified(what, c);
+            inScope(what, [c], names, readable, flags.slice(0, i));
+        }
+    });
+    for (const [map, w] of Object.entries(m.step.maps ?? {})) {
+        const what = `${m.name}'s write to ${map}`;
+        if ('each' in w) {
+            bound(what, w.each, w.value);
+            unquantified(what, w.value);
+            inScope(what, [w.value], [...names, w.each], readable, flags);
+        }
+        else {
+            unquantified(what, w.key);
+            unquantified(what, w.value);
+            inScope(what, [w.key, w.value], names, readable, flags);
+        }
+    }
+    for (const e of Object.values(m.step.state ?? {}))
+        unquantified(`${m.name}'s step`, e);
+    inScope(`${m.name}'s step`, Object.values(m.step.state ?? {}), names, readable, flags);
+    if (m.assume) {
+        unquantified(`${m.name}'s assumption`, m.assume);
+        inScope(`${m.name}'s assumption`, [m.assume], names, readable, flags);
+    }
     if (m.pre)
         inScope(`${m.name}'s precondition`, [m.pre], m.params);
-    distinct(`${m.name}'s laws`, laws.map(l => l.name));
-    for (const law of laws) {
-        if (law.forall && [...names, ...maps].includes(law.forall))
-            throw new Error(`law ${law.name}'s key ${law.forall} is already a name of ${m.name}`);
-        inScope(`law ${law.name}`, [law.holds], [...m.params, ...state, ...(law.forall ? [law.forall] : [])], maps);
+    const facts = m.facts ?? [];
+    distinct(`${m.name}'s laws and facts`, [...laws, ...facts].map(l => l.name));
+    for (const law of [...laws, ...facts]) {
+        const what = facts.includes(law) ? `fact ${law.name}` : `law ${law.name}`;
+        for (const key of [law.forall, ...(law.keys ?? [])])
+            if (key && [...names, ...maps, ...carried, ...fns].includes(key))
+                throw new Error(`${what}'s key ${key} is already a name of ${m.name}`);
+        if (law.keys?.length && (!law.forall || new Set([law.forall, ...law.keys]).size !== law.keys.length + 1))
+            throw new Error(`${what}: further keys come with a first, each a different name`);
+        if (law.name.startsWith('?'))
+            throw new Error(`${what}: a name starting with ? is a flag's (its instances)`);
+        unquantified(what, law.holds);
     }
+    const keysOf = (l) => [...(l.forall ? [l.forall] : []), ...(l.keys ?? [])];
+    for (const law of laws)
+        inScope(`law ${law.name}`, [law.holds], [...m.params, ...state, ...keysOf(law)], [...maps, ...fns]);
+    // A fact reads the params and the functions alone: what holds of them holds at every state.
+    for (const fact of facts)
+        inScope(`fact ${fact.name}`, [fact.holds], [...m.params, ...keysOf(fact)], fns);
+}
+// A key bound in t is read in key terms only: the key, or the key plus or less a term that doesn't read it (k + e, e + k,
+// k ∸ e), each a map's key (no function's: a function's values don't stop where a map's cells do) or a side of a
+// comparison whose other side doesn't read the key. Then t is constant between finitely many keys (the runtimes'
+// breakpoints: each map's cells and each compared value, shifted by the offsets), so a runtime decides it on those.
+const readsKey = (t, key) => JSON.stringify(t).includes(`"op":"var","name":${JSON.stringify(key)}`);
+export const keyTerm = (e, key) => e.op === 'var' ? e.name === key
+    : e.op === 'add' ? (e.a.op === 'var' && e.a.name === key && !readsKey(e.b, key)) || (e.b.op === 'var' && e.b.name === key && !readsKey(e.a, key))
+        : e.op === 'sub' && e.a.op === 'var' && e.a.name === key && !readsKey(e.b, key);
+function keyOnly(what, t, key, fns = []) {
+    const bad = () => { throw new Error(`${what}: the key ${key} is read only in a map's key or a comparison, alone or plus or less a term that doesn't read it`); };
+    const walk = (u) => {
+        switch (u.op) {
+            case 'var':
+                if (u.name === key)
+                    bad();
+                break;
+            case 'get':
+                if (!(keyTerm(u.key, key) && !fns.includes(u.map)))
+                    walk(u.key);
+                break;
+            case 'const':
+            case 'flag': break;
+            case 'not':
+                walk(u.x);
+                break;
+            case 'all':
+                walk(u.c);
+                break;
+            case 'and':
+            case 'or':
+                u.xs.forEach(walk);
+                break;
+            case 'mul':
+                walk(u.a);
+                break;
+            case 'if':
+                walk(u.c);
+                walk(u.then);
+                walk(u.else);
+                break;
+            case '<':
+            case '<=':
+            case '=':
+                if (keyTerm(u.a, key) && !readsKey(u.b, key))
+                    walk(u.b);
+                else if (keyTerm(u.b, key) && !readsKey(u.a, key))
+                    walk(u.a);
+                else {
+                    walk(u.a);
+                    walk(u.b);
+                }
+                break;
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod':
+                walk(u.a);
+                walk(u.b);
+                break;
+            default: unreachable(u);
+        }
+    };
+    walk(t);
+}
+// Whether the key is read only as a map's key, plainly (what the GPU searches decide: every cell, and one past them).
+export const plainKey = (t, key) => {
+    const walk = (u) => {
+        switch (u.op) {
+            case 'var': return u.name !== key;
+            case 'get': return (u.key.op === 'var' && u.key.name === key) || walk(u.key);
+            case 'const':
+            case 'flag': return true;
+            case 'not': return walk(u.x);
+            case 'all': return walk(u.c);
+            case 'and':
+            case 'or': return u.xs.every(walk);
+            case 'mul': return walk(u.a);
+            case 'if': return walk(u.c) && walk(u.then) && walk(u.else);
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod':
+            case '<':
+            case '<=':
+            case '=': return walk(u.a) && walk(u.b);
+            default: return unreachable(u);
+        }
+    };
+    return walk(t);
+};
+// No quantifier inside t: a quantifier is a whole flag.
+function unquantified(what, t) {
+    if (JSON.stringify(t).includes('"op":"all"'))
+        throw new Error(`${what}: a condition at every key is a flag of its own (flags: {name: all(...)})`);
 }
 // --- histories ---------------------------------------------------------------------------------------------------------
 // A term or condition that reads only these names, and no map.
@@ -383,6 +623,8 @@ export function historyMachine(m) {
     const h = m.history;
     if (!h)
         return { machine: m, goals: [] };
+    if (m.inputMaps?.length || quantified(m).length || Object.values(m.step.maps ?? {}).some(w => 'each' in w))
+        throw new Error(`${m.name}: a machine with a history has no maps carried by requests, quantified flags or writes at every key`);
     const queries = Object.keys(h.queries), sums = Object.keys(h.sums), plainInputs = m.inputs.filter(i => !queries.includes(i));
     const fields = h.record.map(f => `r.${f}`);
     const taken = [...m.params, ...m.inputs, ...Object.keys(m.state), ...Object.keys(m.step.state ?? {})];
@@ -425,32 +667,22 @@ export function obligations(m, laws, instances = {}) {
         return [...obligations(machine, laws, instances), ...goals];
     }
     scope(m, laws);
-    const ok = [...Object.values(m.state), ...Object.values(m.step.state ?? {}), ...Object.values(m.step.maps ?? {}).flatMap(w => [w.key, w.value])].every(natural)
+    const ok = [...Object.values(m.state), ...Object.values(m.step.state ?? {}), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.value] : [w.key, w.value]))].every(natural)
         && Object.values(m.step.flags ?? {}).every(naturalC) && laws.every(l => naturalC(l.holds)) && Object.values(m.maps ?? {}).every(c => Number.isInteger(c) && c >= 0);
-    if (!ok || laws.some(l => mentions(l.holds, m.inputs)))
+    if (!ok || !(m.facts ?? []).every(l => naturalC(l.holds)) || laws.some(l => mentions(l.holds, m.inputs)))
         throw new Error('a negative constant or factor, or a law about a request, is outside the kernel');
-    const fresh = (law) => `${law.forall}#`;
-    const atKey = (law, key) => substC(law.holds, { vars: { [law.forall]: key }, maps: {}, flags: {} });
-    const goal = (law) => (law.forall ? atKey(law, { op: 'var', name: fresh(law) }) : law.holds);
-    const pre = preOf(m);
-    // At the start: the precondition, and no request.
-    const start = { vars: Object.fromEntries(Object.entries(m.state)), maps: Object.fromEntries(Object.entries(m.maps ?? {}).map(([map, c]) => [map, () => ({ op: 'const', value: c })])), flags: {} };
-    // One step: the state after, as terms over the state before; a map read after the step is the written value at the
-    // written key, and the old cell elsewhere.
-    const flags = { vars: {}, maps: {}, flags: m.step.flags ?? {} };
-    const inline = (c) => substC(c, flags), inlineE = (e) => substE(e, flags);
-    const step = {
-        vars: Object.fromEntries(Object.entries(m.step.state ?? {}).map(([name, e]) => [name, inlineE(e)])),
-        flags: {},
-        maps: Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([map, w]) => [map, (key) => ({ op: 'if', c: { op: '=', a: key, b: inlineE(w.key) }, then: inlineE(w.value), else: { op: 'get', map, key } })])),
-    };
-    const out = [];
-    for (const law of laws) {
-        out.push({ name: `${law.name} @start`, hyps: [...pre, { op: 'not', x: substC(goal(law), start) }] });
-        const before = laws.flatMap(l => (l.forall ? (instances[law.name]?.[l.name] ?? []).map(key => atKey(l, key)) : [l.holds]));
-        out.push({ name: `${law.name} @step`, hyps: [...pre, ...(m.assume ? [inline(m.assume)] : []), ...before, { op: 'not', x: substC(goal(law), step) }] });
-    }
-    return out;
+    // A law that holds at every key is proven at a fresh one.
+    // A law about every two keys keeps its second key as it is: a fresh name nothing else reads, so the goal is about every
+    // value of it too (the Lean twin reads it so).
+    const proven = (law) => (law.forall ? substC(law.holds, { vars: { [law.forall]: { op: 'var', name: `${law.forall}#` } }, maps: {}, flags: {} }) : law.holds);
+    const pre = preOf(m), u = updateOf(m), assume = m.assume ? [inlineFlags(m, m.assume)] : [];
+    return laws.flatMap(law => {
+        // At the start: the precondition, and no request. One step: from a state where the laws hold, a request allowed.
+        // The facts hold throughout, read where the run begins (they read no state).
+        const start = given(m, holds(from(startOf(m)), pre), instances[law.name] ?? {});
+        const turn = step(holds(given(m, from(), instances[law.name] ?? {}), [...pre, ...assume, ...assumed(laws, instances[law.name] ?? {}), ...closing(m, instances[law.name] ?? {})]), u);
+        return [goal(`${law.name} @start`, start, atEnd(start, proven(law))), goal(`${law.name} @step`, turn, atEnd(turn, proven(law)))];
+    });
 }
 // The whole set at once: every goal has a tree, and every tree checks.
 export function checkLaws(m, laws, proof) {
@@ -474,17 +706,14 @@ export function loopObligations(l, laws, rank) {
     inScope(`${l.name}'s rank and laws`, [...ranks, ...laws.map(law => law.holds)], [...l.params, ...Object.keys(l.state)]);
     if (ranks.some(r => mentions({ op: '=', a: r, b: r }, l.inputs)))
         throw new Error('a rank reads the state and params, not the turn\'s input');
-    if (!parts.every(natural) || !naturalC(l.while) || !laws.every(law => !law.forall && naturalC(law.holds) && !mentions(law.holds, l.inputs)))
+    if (!parts.every(natural) || !naturalC(l.while) || !laws.every(law => !law.forall && !law.keys?.length && naturalC(law.holds) && !mentions(law.holds, l.inputs)))
         throw new Error('outside the kernel');
-    const start = { vars: l.state, maps: {}, flags: {} }, turn = { vars: l.body, maps: {}, flags: {} };
     const pre = preOf(l);
-    const during = [...pre, ...(l.assume ? [l.assume] : []), l.while, ...laws.map(law => law.holds)];
+    const start = holds(from({ vars: { ...l.state }, maps: {}, flags: {} }), pre);
+    const turn = step(holds(from(), [...pre, ...(l.assume ? [l.assume] : []), l.while, ...laws.map(law => law.holds)]), { vars: l.body, maps: {} });
     return [
-        ...laws.flatMap(law => [
-            { name: `${law.name} @start`, hyps: [...pre, { op: 'not', x: substC(law.holds, start) }] },
-            { name: `${law.name} @turn`, hyps: [...during, { op: 'not', x: substC(law.holds, turn) }] },
-        ]),
-        { name: 'rank drops', hyps: [...during, { op: 'not', x: drops(ranks, turn) }] },
+        ...laws.flatMap(law => [goal(`${law.name} @start`, start, atEnd(start, law.holds)), goal(`${law.name} @turn`, turn, atEnd(turn, law.holds))]),
+        goal('rank drops', turn, drops(ranks, turn.at)),
     ];
 }
 const drops = (ranks, turn) => {
@@ -504,57 +733,105 @@ export function progressObligations(m, laws, instances, p) {
         if (mentions({ op: '=', a: e, b: e }, m.inputs))
             throw new Error('a request is named from the state and params');
     const req = { vars: p.request, maps: {}, flags: {} };
-    const flags = Object.fromEntries(Object.entries(m.step.flags ?? {}).map(([f, c]) => [f, substC(c, req)]));
-    const now = (e) => substE(substE(e, { vars: {}, maps: {}, flags: m.step.flags ?? {} }), req);
-    const after = {
-        vars: { ...p.request, ...Object.fromEntries(Object.keys(m.state).map(n => [`${n}'`, { op: 'var', name: n }])), ...Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [`${n}'`, now(e)])) },
-        maps: {
-            ...Object.fromEntries(Object.keys(m.maps ?? {}).map(map => [`${map}'`, (key) => ({ op: 'get', map, key })])),
-            ...Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([map, w]) => [`${map}'`, (key) => ({ op: 'if', c: { op: '=', a: key, b: now(w.key) }, then: now(w.value), else: { op: 'get', map, key } })])),
-        },
-        flags,
-    };
-    const before = [...preOf(m), ...laws.flatMap(l => (l.forall ? (instances[l.name] ?? []).map(key => substC(l.holds, { vars: { [l.forall]: key }, maps: {}, flags: {} })) : [l.holds])), p.when];
+    const flags = Object.fromEntries(Object.entries(flagsOf(m)).map(([f, c]) => [f, substC(c, req)]));
+    // The run: a state where the laws and `when` hold, the named request (its quantified flags closed), then the step it
+    // causes. Maps a request carries are left as any maps: the step is shown for all of them.
+    const before = holds(given(m, from(), instances), [...preOf(m), ...assumed(laws, instances), p.when]);
+    const asked = holds(reading(before, p.request), closing(m, instances));
+    const caused = step(asked, updateOf(m));
     return [
-        ...(m.assume ? [{ name: `${p.name}: the request is allowed`, hyps: [...before, { op: 'not', x: substC(m.assume, req) }] }] : []),
-        { name: `${p.name}: the step it causes`, hyps: [...before, { op: 'not', x: substC(p.then, after) }] },
+        ...(m.assume ? [goal(`${p.name}: the request is allowed`, asked, substC(inlineFlags(m, m.assume), req))] : []),
+        goal(`${p.name}: the step it causes`, caused, across(caused, p.then, Object.keys(m.state), Object.keys(m.maps ?? {}), { inputs: p.request, flags })),
     ];
 }
+const zero = { op: 'const', value: 0 };
+export const trueC = { op: '<=', a: zero, b: zero }, falseC = { op: '<', a: zero, b: zero };
+const and2 = (a, b) => ({ op: 'and', xs: [a, b] }), or2 = (a, b) => ({ op: 'or', xs: [a, b] });
+const lexLt = (after, before) => (after.length && before.length ? or2({ op: '<', a: after[0], b: before[0] }, and2({ op: '=', a: after[0], b: before[0] }, lexLt(after.slice(1), before.slice(1)))) : falseC);
+const eqs = (after, before) => (after.length && before.length ? and2({ op: '=', a: after[0], b: before[0] }, eqs(after.slice(1), before.slice(1))) : trueC);
+const keep = (ws, prime) => (ws.length ? and2(or2({ op: 'not', x: ws[0] }, prime(ws[0])), keep(ws.slice(1), prime)) : trueC);
+const anyOf = (ws) => (ws.length ? or2(ws[0], anyOf(ws.slice(1))) : falseC);
+const named = (req) => (req.length ? and2({ op: '=', a: { op: 'var', name: req[0][0] }, b: req[0][1] }, named(req.slice(1))) : trueC);
+export const livenessRanks = (l) => (Array.isArray(l.rank) ? l.rank : [l.rank]);
+export const livenessHelpful = (l) => {
+    if ((l.request === undefined) === (l.helpful === undefined))
+        throw new Error(`liveness ${l.name}: a helpful request, or helpful requests with their regions`);
+    return (l.helpful ?? [{ request: l.request }]).map(h => ({ when: h.when ?? trueC, request: h.request }));
+};
+export function livenessParts(m, l) {
+    // A machine with a history as its plain machine (its sums are state, its queries inputs no request names).
+    const plain = m.history ? historyMachine(m).machine : m;
+    const queries = Object.keys(m.history?.queries ?? {}), client = plain.inputs.filter(i => !queries.includes(i));
+    const ranks = livenessRanks(l), helpful = livenessHelpful(l);
+    if (!ranks.length || !helpful.length)
+        throw new Error(`liveness ${l.name}: a rank of one natural or more, and a helpful request or more`);
+    for (const [what, t] of [['from', l.from], ['to', l.to], ...ranks.map((r, i) => [`rank ${i + 1}`, { op: '=', a: r, b: r }]), ...helpful.map((h, i) => [`region ${i + 1}`, h.when])]) {
+        if (mentions(t, plain.inputs))
+            throw new Error(`liveness ${l.name}: ${what} reads the state and params, not a request`);
+    }
+    for (const h of helpful)
+        for (const [input, t] of Object.entries(h.request)) {
+            if (!client.includes(input))
+                throw new Error(`liveness ${l.name}: a helpful request names inputs a client sends (${input} is ${queries.includes(input) ? 'a query, computed from the log' : 'none'})`);
+            if (mentions({ op: '=', a: t, b: t }, plain.inputs))
+                throw new Error(`liveness ${l.name}: the request's ${input} is a term over the state and params`);
+        }
+    const after = { vars: Object.fromEntries(Object.keys(plain.state).map(n => [n, { op: 'var', name: `${n}'` }])), maps: Object.fromEntries(Object.keys(plain.maps ?? {}).map(map => [map, (key) => ({ op: 'get', map: `${map}'`, key })])), flags: {} };
+    const prime = (c) => substC(c, after), ranks2 = ranks.map(r => substE(r, after)), to2 = prime(l.to);
+    const pending = and2(l.from, { op: 'not', x: l.to }), lower = lexLt(ranks2, ranks), regions = helpful.map(h => h.when);
+    return {
+        stay: { name: `${l.name}: each step stays or gets there, the rank kept only with its region`, when: pending,
+            then: and2(or2(prime(l.from), to2), or2(to2, or2(lower, and2(eqs(ranks2, ranks), keep(regions, prime))))) },
+        cover: { name: `${l.name}: some helpful request applies`, when: pending, then: anyOf(regions) },
+        helps: helpful.map((h, i) => ({ name: `${l.name}: helpful request ${i + 1}`, when: and2(pending, and2(h.when, named(Object.entries(h.request)))), then: or2(to2, lower) })),
+    };
+}
 export function stepLawObligations(machine, laws, instances, sl) {
     const m = machine.history ? historyMachine(machine).machine : machine;
     scope(m, laws);
-    const state = Object.keys(m.state), maps = Object.keys(m.maps ?? {}), flagNames = Object.keys(m.step.flags ?? {});
+    const k = sl.steps ?? 1;
+    if (!Number.isInteger(k) || k < 1 || k > 16)
+        throw new Error(`step law ${sl.name}: steps is a whole number from 1 to 16`);
+    const whens = sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when];
+    if (whens.length > k)
+        throw new Error(`step law ${sl.name}: one when per step at most`);
+    const state = Object.keys(m.state), maps = Object.keys(m.maps ?? {}), carried = m.inputMaps ?? [], flagNames = Object.keys(m.step.flags ?? {});
     const primes = [...state, ...maps].map(n => `${n}'`);
-    const taken = [...m.params, ...m.inputs, ...state, ...maps];
-    for (const p of primes)
+    const laters = Array.from({ length: k - 1 }, (_, i) => laterNames(m, i + 2));
+    const later = laters.flatMap(l => Object.values(l.vars).map(e => e.name)), laterMaps = laters.flatMap(l => Object.values(l.maps));
+    const taken = [...m.params, ...m.inputs, ...state, ...maps, ...carried];
+    for (const p of [...primes, ...later, ...laterMaps])
         if (taken.includes(p))
-            throw new Error(`${m.name}: ${p} is a name of the machine and a primed name of a step law`);
-    if (sl.forall && [...taken, ...primes].includes(sl.forall))
-        throw new Error(`step law ${sl.name}'s key ${sl.forall} is already a name of ${m.name}`);
-    inScope(`step law ${sl.name}`, [sl.then], [...taken, ...state.map(n => `${n}'`), ...(sl.forall ? [sl.forall] : [])], [...maps, ...maps.map(n => `${n}'`)], flagNames);
-    if (sl.when)
-        inScope(`step law ${sl.name}'s when`, [sl.when], taken, maps, flagNames);
-    if (!naturalC(sl.then) || (sl.when && !naturalC(sl.when)))
+            throw new Error(`${m.name}: ${p} is a name of the machine and a name a step law reads`);
+    for (const key of [sl.forall, ...(sl.keys ?? [])])
+        if (key && [...taken, ...primes, ...later].includes(key))
+            throw new Error(`step law ${sl.name}'s key ${key} is already a name of ${m.name}`);
+    if (sl.keys?.length && (!sl.forall || new Set([sl.forall, ...sl.keys]).size !== sl.keys.length + 1))
+        throw new Error(`step law ${sl.name}: further keys come with a first, each a different name`);
+    unquantified(`step law ${sl.name}`, sl.then);
+    inScope(`step law ${sl.name}`, [sl.then], [...taken, ...state.map(n => `${n}'`), ...later, ...(sl.forall ? [sl.forall] : []), ...(sl.keys ?? [])], [...maps, ...carried, ...maps.map(n => `${n}'`), ...laterMaps], flagNames);
+    for (const w of whens) {
+        unquantified(`step law ${sl.name}'s when`, w);
+        inScope(`step law ${sl.name}'s when`, [w], taken, [...maps, ...carried], flagNames);
+    }
+    if (!naturalC(sl.then) || !whens.every(naturalC))
         throw new Error(`step law ${sl.name}: a negative constant or factor is outside the kernel`);
-    const flags = { vars: {}, maps: {}, flags: m.step.flags ?? {} };
-    const now = (e) => substE(e, flags), nowC = (c) => substC(c, flags);
-    const after = {
-        vars: Object.fromEntries(state.map(n => [`${n}'`, now(m.step.state?.[n] ?? { op: 'var', name: n })])),
-        maps: Object.fromEntries(maps.map(map => {
-            const w = m.step.maps?.[map];
-            return [`${map}'`, (key) => (w ? { op: 'if', c: { op: '=', a: key, b: now(w.key) }, then: now(w.value), else: { op: 'get', map, key } } : { op: 'get', map, key })];
-        })),
-        flags: m.step.flags ?? {},
-    };
-    const before = laws.flatMap(l => (l.forall ? (instances[l.name] ?? []).map(key => substC(l.holds, { vars: { [l.forall]: key }, maps: {}, flags: {} })) : [l.holds]));
-    return [{ name: `${sl.name} @step law`, hyps: [...preOf(m), ...before, ...(m.assume ? [nowC(m.assume)] : []), ...(sl.when ? [nowC(sl.when)] : []), { op: 'not', x: substC(sl.then, after) }] }];
+    const u = updateOf(m), assume = m.assume ? [inlineFlags(m, m.assume)] : [];
+    let run = given(m, holds(from(), preOf(m)), instances);
+    for (let j = 1; j <= k; j++) {
+        if (j > 1)
+            run = reading(run, laters[j - 2].vars, laters[j - 2].maps);
+        run = step(holds(run, [...assumed(laws, instances), ...assume, ...(whens[j - 1] ? [inlineFlags(m, whens[j - 1])] : []), ...closing(m, instances)]), u);
+    }
+    return [goal(k === 1 ? `${sl.name} @step law` : `${sl.name} @${k} steps`, run, across(run, sl.then, state, maps, { inputs: {}, flags: flagsOf(m) }))];
 }
 // The laws' proof and every step law's tree: all must check.
+// `perStep`: a step law's own instances, where it has them (else `instances`).
 export function checkStepLaws(m, laws, stepLaws, proof) {
-    return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => stepLawObligations(m, laws, proof.instances, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name])));
+    return checkLaws(m, laws, proof.laws) && stepLaws.every(sl => stepLawObligations(m, laws, proof.perStep?.[sl.name] ?? proof.instances, sl).every(g => proof.trees[g.name] !== undefined && check(g, proof.trees[g.name])));
 }
 export function foldObligations(f, laws) {
-    if (![...Object.values(f.leaf), ...Object.values(f.node)].every(natural) || !laws.every(law => !law.forall && naturalC(law.holds) && !mentions(law.holds, f.inputs)))
+    if (![...Object.values(f.leaf), ...Object.values(f.node)].every(natural) || !laws.every(law => !law.forall && !law.keys?.length && naturalC(law.holds) && !mentions(law.holds, f.inputs)))
         throw new Error('outside the kernel');
     const names = Object.keys(f.leaf);
     distinct(f.name, [...f.params, ...f.inputs, ...names]);
@@ -566,9 +843,9 @@ export function foldObligations(f, laws) {
     inScope(`${f.name}'s laws`, laws.map(law => law.holds), [...f.params, ...names]);
     const side = (p) => ({ vars: Object.fromEntries(names.map(n => [n, { op: 'var', name: `${p}${n}` }])), maps: {}, flags: {} });
     // A fold's inputs are each leaf's and node's own, so its assumption holds at every leaf and node it reads them at.
+    // A leaf is a start from its inputs; a node, a step from the frame of its two children, the laws holding at each.
     const assume = [...preOf(f), ...(f.assume ? [f.assume] : [])];
-    return laws.flatMap(law => [
-        { name: `${law.name} @leaf`, hyps: [...assume, { op: 'not', x: substC(law.holds, { vars: f.leaf, maps: {}, flags: {} }) }] },
-        { name: `${law.name} @node`, hyps: [...assume, ...laws.flatMap(h => [substC(h.holds, side('l_')), substC(h.holds, side('r_'))]), { op: 'not', x: substC(law.holds, { vars: f.node, maps: {}, flags: {} }) }] },
-    ]);
+    const leaf = holds(from({ vars: { ...f.leaf }, maps: {}, flags: {} }), assume);
+    const node = step(holds(from(), [...assume, ...laws.flatMap(h => [substC(h.holds, side('l_')), substC(h.holds, side('r_'))])]), { vars: f.node, maps: {} });
+    return laws.flatMap(law => [goal(`${law.name} @leaf`, leaf, atEnd(leaf, law.holds)), goal(`${law.name} @node`, node, atEnd(node, law.holds))]);
 }

package/dist/kernel/prove.d.ts

@@ -1,5 +1,5 @@
-import type { Law, Machine } from '../core/machine.js';
-import { type Goal, type Instances, type Path, type StepLaw, type Tree } from './kernel.js';
+import type { C, E, Law, Machine } from '../core/machine.js';
+import { type Goal, type Instances, type Liveness, type Path, type StepLaw, type Tree } from './kernel.js';
 export type Outcome = {
     tree: Tree;
     nodes: number;
@@ -24,20 +24,44 @@ export type Report = {
     checked: boolean;
 };
 export declare function proveLaws(m: Machine, laws: Law[]): Report & {
+    laws?: Law[];
     proof?: {
         instances: Record<string, Instances>;
         trees: Record<string, Tree>;
     };
 };
-export declare function proveStepLaws(m: Machine, laws: Law[], stepLaws: StepLaw[]): Report & {
-    proof?: {
-        laws: {
-            instances: Record<string, Instances>;
-            trees: Record<string, Tree>;
-        };
-        instances: Instances;
+type StepProof = {
+    laws: {
+        instances: Record<string, Instances>;
         trees: Record<string, Tree>;
     };
+    instances: Instances;
+    perStep?: Record<string, Instances>;
+    trees: Record<string, Tree>;
+};
+export declare function proveStepLaws(m: Machine, given: Law[], stepLaws: StepLaw[]): Report & {
+    laws?: Law[];
+    stepLaws?: StepLaw[];
+    proof?: StepProof;
+};
+export declare function proveProgress(m: Machine, laws: Law[], p: {
+    name: string;
+    when: C;
+    then: C;
+    request: Record<string, E>;
+}): Report & {
+    instances?: Instances;
+    trees?: Record<string, Tree>;
+};
+export declare function proveLiveness(m: Machine, laws: Law[], l: Liveness): Report & {
+    steps?: ReturnType<typeof proveStepLaws>;
 };
 export declare const countLeaves: (t: Tree) => number;
 export declare function concretize(goal: Goal, bound?: number): Record<string, number> | undefined;
+export declare function proveBuilt(m: Machine, laws: Law[], build: (inst: Instances) => Goal): {
+    proven: boolean;
+    instances?: Instances;
+    goal?: Goal;
+    tree?: Tree;
+};
+export {};