gdp-wired 0.10.1 → 0.11.0

package/README.md

@@ -69,8 +69,9 @@ All of these are proven automatically, and each proof is also a Lean theorem:
   (`examples/datatypes.ts`).
 - **Lists a request carries, and trees**: an invoice's lines, with folds over them (the total, the taxable part) and
   lemmas about the folds proven by induction over the lines (`examples/invoices.ts`); a fold over a tree as a value (a
-  spend roll-up over an org chart, sign-offs over a document's sections), its laws proven by induction over the tree
-  (`examples/folds.ts`).
+  spend roll-up, sign-offs over a document's sections, an org chart where a manager has any number of reports), its laws
+  proven by induction over the tree (`examples/folds.ts`); a search tree, and a sheet of rows of cells, kept in a rule's
+  state as tables of nodes (`examples/trees.ts`).
 - **Pure functions and two-run laws**: laws about what a function returns, and laws comparing two calls, like "the
   secret never changes the answer". `examples/jev-fabric/` ports a Bend project's policy core and proves all 59 laws its
   Bend proofs state.
@@ -228,13 +229,24 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   carried map of its running values whose equations every request is assumed to meet (the encoding computes them from the
   array, and a request that doesn't meet them isn't allowed), read as `Lines.fold.total`; `Lines.every`, `some`, `has`,
   `increasing(by)`, `at(i)`. A lemma about the folds (`({taxed, total}) => taxed.atMost(total)`) is proven by induction
-  over the items when the rule is built, then assumed at every prefix (`examples/invoices.ts`).
+  over the items when the rule is built, then assumed at every prefix. A fold's start and step, and a lemma, may read the
+  params (`{from: ({fee}) => fee, step: (acc, line, {ceil}) => acc.plus(min(line.amount, ceil))}`); a request is then
+  encoded with them, `rule.encodeInput(values, params)` (`examples/invoices.ts`).
 - **Folds over trees** (`fold(name).params(...).inputs(...).leaf(env => ({...})).node((env, left, right) => ({...}))`,
   `proveFold`): a tree as a value (`{leaf: inputs}` or `{node: inputs, left, right}`), each leaf's values from its inputs
   and each node's from its own and its children's; a law about the values is proven by induction over the tree (the
   kernel's leaf and node goals, Lean's `fold_sound`), `f.run(tree, params)` evaluates the terms proven and `f.crossCheck`
-  holds the builders to them (`examples/folds.ts`). A tree in a rule's state, and claims that need a lemma about the
-  tree's shape nobody stated, stay Lean's.
+  holds the builders to them. Nodes with any number of children: `.children(from, (acc, kid) => ..., lemmas)` folds a
+  node's children into `kids`, then `.node((env, kids) => ...)`; it is the kernel's binary fold underneath (each child
+  list a chain of glue nodes), so Lean's `fold_sound` checks it unchanged, and `f.run` takes `{node, children: [...]}`
+  (`examples/folds.ts`).
+- **Trees in a rule's state, and lists of lists** (`.nodes('Tree', record({key: nat}), ['left', 'right'], folds)`): a
+  table of nodes that only grows, node 0 the empty tree, `Tree.make(value, {left, right}, when)` making node size + 1 from
+  nodes already there; each fold (`{lo: {empty: 0, node: (x, kids) => when(kids.left.empty, x.key, kids.left.fold.lo)}}`)
+  kept with its node when it is made, and may read a table declared before (a row's total over its cells). A law about
+  a subtree is then a law about one node (`Tree.node(n).fold.lo`), proven like any law about every key; the table's own
+  laws (children earlier, folds coherent, nothing past the end) are proven beside it (`examples/trees.ts`: a search tree,
+  a sheet of rows of cells). Claims that need a lemma about the tree's shape nobody stated stay Lean's.
 - **State of any kind**: `.state({open: bool.from(true), status: oneOf('new', 'done').from('new'), owner: str().from(''), note: maybe(nat).from(null)})`;
   a step writes each kind's own values, `when(c, a, b)` chooses between any two values of a kind, and `rule.decode(state)`
   reads them back as runtime values.
@@ -329,7 +341,7 @@ Lean, compiled natively, wins where the state stays small. Details in [`docs/com
 | `core/` | Machines, the interpreter and JS compiler, the builders, composition (`compose.ts`), the linear solver and its checker, Houdini invariants, models, the first Lean export |
 | `kernel/` | The trusted kernel and the untrusted prover, with soundness fuzz (`kernel.test.ts`, `history.test.ts`) |
 | `lean-kernel/` | The kernel's Lean twin, its soundness proofs, and the exported trees |
-| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
+| `examples/` | The builders at work: `domains/` (187 rules across 21 domains, each with laws and broken variants), `harness.ts` (the triple check), `readme.ts`, `budget.ts`, `gdp.ts` (gdp-ts's example, its checks proven), `datatypes.ts` (records and variants), `lemmas.ts` (recurrences and their lemmas), `invoices.ts` (lists a request carries), `folds.ts` (folds over trees), `trees.ts` (trees and lists of lists in the state), `composition.ts`, `sets.ts`, `quantifiers.ts`, `functions.ts`, `lists.ts`, `sizes.ts`, `liveness.ts`, `steps.ts` (laws over up to 16 steps), and `jev-fabric/` (a Bend project's 59 proven laws, ported) |
 | `docs/` | The comparison with Bend and Lean, and the full scope |
 | `compare/` | The same three rules in gdp-wired, Bend and plain Lean, checked and measured |
 | `research/` | Everything around the library ([`research/README.md`](research/README.md)): the GPU searches (`search/`, `hw/`, `modal-gpu/`), invariant and rank synthesis (`synth/`), relational laws and guard synthesis (`next/`), bit-vector laws (`sat/`), the enumeration and benchmarks (`enum/`, `gpu/`, `perf/`), the first Lean checker (`lean/`) and the first prototype, the audit path (`audit/`) |

package/dist/core/dsl.d.ts

@@ -310,11 +310,11 @@ export type ItemsOp = {
     readonly parts: Record<string, ListOp>;
     readonly len: TermLike;
 };
-export type ListFold<V> = {
-    from: number;
-    step: (acc: Term, item: V) => TermLike;
+export type ListFold<V, P = any> = {
+    from: number | ((p: P) => TermLike);
+    step: (acc: Term, item: V, p: P) => TermLike;
 };
-export type ListLemma = (acc: Record<string, Term>, i: Term) => Cond;
+export type ListLemma<P = any> = (acc: Record<string, Term>, i: Term, p: P) => Cond;
 export declare class CarriedList<V, Fd extends string = never> {
     readonly name: string;
     readonly kind: Kind<V>;
@@ -322,8 +322,10 @@ export declare class CarriedList<V, Fd extends string = never> {
     readonly folds: Record<Fd, ListFold<V>>;
     private readonly map;
     readonly lemmas: Record<string, ListLemma>;
+    private readonly params?;
+    private readonly paramKinds;
     readonly fold: Record<Fd, Term>;
-    constructor(name: string, kind: Kind<V>, len: Term, folds: Record<Fd, ListFold<V>>, map: (part: string) => MapRef, lemmas?: Record<string, ListLemma>);
+    constructor(name: string, kind: Kind<V>, len: Term, folds: Record<Fd, ListFold<V>>, map: (part: string) => MapRef, lemmas?: Record<string, ListLemma>, params?: Record<string, unknown> | undefined, paramKinds?: [string, Kind<unknown>][]);
     at(i: TermLike): V;
     after(fold: Fd, i: TermLike): Term;
     every(f: (item: V, i: Term) => Cond): Cond;
@@ -331,6 +333,8 @@ export declare class CarriedList<V, Fd extends string = never> {
     has(x: V): Cond;
     increasing(by: (item: V) => Term): Cond;
     equations(): Cond[];
+    private get readsParams();
+    private p;
     private running;
     prove(): Verdict;
     get maps(): string[];
@@ -358,6 +362,35 @@ export declare class ItemsRef<V> {
     within(): Forall;
     increasing(by: (x: V) => Term): Forall;
 }
+export type NodeRef<V, C extends string, Fd extends string> = {
+    readonly index: Term;
+    readonly empty: Cond;
+    readonly value: V;
+    readonly fold: Record<Fd, Term>;
+    readonly kids: Record<C, Term>;
+};
+export type NodeFold<V, C extends string, Fd extends string = string, T = Record<string, NodeTable<any, any, any>>> = {
+    empty: number;
+    node: (value: V, kids: Record<C, NodeRef<V, C, Fd>>, tables: T) => TermLike;
+};
+type TablesOf<M> = {
+    [k in keyof M as M[k] extends NodeTable<any, any, any> ? k : never]: M[k];
+};
+export declare class NodeTable<V, C extends string = string, Fd extends string = string> {
+    readonly name: string;
+    readonly kind: Kind<V>;
+    readonly children: C[];
+    readonly folds: Record<Fd, NodeFold<V, C, Fd>>;
+    readonly size: Term;
+    private readonly map;
+    private readonly tables;
+    constructor(name: string, kind: Kind<V>, children: C[], folds: Record<Fd, NodeFold<V, C, Fd>>, size: Term, map: (part: string) => MapRef, tables?: Record<string, NodeTable<any, any, any>>);
+    node(n: TermLike): NodeRef<V, C, Fd>;
+    at(n: TermLike): V;
+    fits(kids: Record<C, TermLike>): Cond;
+    make(value: Writes<V>, kids: Record<C, TermLike>, when?: Cond): Record<string, TermLike | PartsWrite>;
+    laws(): [string, Forall][];
+}
 export type Forall = {
     readonly forall: (key: Term, ...more: Term[]) => Cond;
 };
@@ -419,6 +452,7 @@ type Spec = {
     lists?: string[];
     cells?: [string, Kind<unknown>][];
     items?: [string, Kind<unknown>][];
+    nodes?: [string, Kind<unknown>, string[], Record<string, NodeFold<unknown, string>>][];
     kinded?: [string, Kind<unknown>][];
     carried?: string[];
     lists2?: [string, Kind<unknown>, Record<string, ListFold<unknown>>, Record<string, ListLemma>][];
@@ -467,6 +501,13 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     }, M & {
         [k in keyof T]: ItemsRef<T[k] extends Kind<infer V> ? V : never>;
     }, F, R, Su, Q>;
+    nodes<const N extends string, V, const C extends string, Fd extends string = never>(name: N, of: Kind<V>, children: readonly C[], folds?: {
+        [f in Fd]: NodeFold<V, C, Fd, TablesOf<M>>;
+    }): Rule<P, I, S & {
+        [k in N as `${k}_size`]: Term;
+    }, M & {
+        [k in N]: NodeTable<V, C, Fd>;
+    }, F, R, Su, Q>;
     fns<T extends Record<string, FnDef>>(defs: T): Rule<P & {
         [k in keyof T]: (...args: TermLike[]) => Term;
     }, I, S, M, F, R, Su, Q>;
@@ -474,7 +515,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     carries<const N extends string>(...names: N[]): Rule<P, I & {
         [k in N]: MapRef;
     }, S, M, F, R, Su, Q>;
-    carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term) => Cond>): Rule<P, I & {
+    carriesList<const N extends string, V, Fd extends string = never>(name: N, of: Kind<V>, folds?: Record<Fd, ListFold<V, P>>, lemmas?: Record<string, (acc: Record<Fd, Term>, i: Term, p: P) => Cond>): Rule<P, I & {
         [k in N]: CarriedList<V, Fd>;
     }, S, M, F, R, Su, Q>;
     flags<T extends Record<string, Cond>>(f: (env: P & I & S & M & F & Su & Q) => T): Rule<P, I, S, M, F & {
@@ -550,9 +591,12 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     }): Record<string, number>;
     encodeInput(values: {
         [k in keyof I]: I[k] extends MapRef ? ReadonlySet<number> | readonly number[] | ReadonlyMap<number, number> : I[k] extends CarriedList<any, any> ? readonly Raw[] : Raw;
+    }, params?: {
+        [k in keyof P]: Raw;
     }): Request;
     randomParams(rand: Rand, bound: number): Record<string, number>;
-    randomInput(rand: Rand, bound: number): Request;
+    private paramValues;
+    randomInput(rand: Rand, bound: number, ps?: Record<string, number>): Request;
     decode(st: State): Record<string, Raw>;
     get orderedBy(): string | undefined;
     interpreter(): {
@@ -754,6 +798,15 @@ export declare class FoldRule<P extends Obj = {}, I extends Obj = {}, S extends
     node(f: (env: P & I, left: S, right: S) => {
         [k in keyof S]: TermLike;
     }): FoldRule<P, I, S>;
+    children<A extends Record<string, number | ((p: P) => TermLike)>>(from: A, step: (acc: {
+        [k in keyof A]: Term;
+    }, kid: S, p: P) => {
+        [k in keyof A]: TermLike;
+    }, lemmas?: Record<string, (acc: {
+        [k in keyof A]: Term;
+    }, p: P) => Cond>): RoseFold<P, I, S, {
+        [k in keyof A]: Term;
+    }>;
     private env;
     private names;
     private side;
@@ -774,4 +827,49 @@ export declare class FoldRule<P extends Obj = {}, I extends Obj = {}, S extends
     }): Agreement;
 }
 export declare const fold: (name: string) => FoldRule;
-export declare const proveFold: (f: FoldRule<Obj, Obj, Obj>, laws: Law[]) => Verdict;
+export declare const proveFold: (f: {
+    fold: Fold;
+    lemmas?: Law[];
+}, laws: Law[]) => Verdict;
+export type RoseValue<I> = {
+    leaf: I;
+} | {
+    node: I;
+    children: RoseValue<I>[];
+};
+type RoseSpec = {
+    from: Record<string, number | ((p: never) => TermLike)>;
+    step: (acc: never, kid: never, p: never) => Record<string, TermLike>;
+    lemmas: Record<string, (acc: never, p: never) => Cond>;
+};
+export declare class RoseFold<P extends Obj = {}, I extends Obj = {}, S extends Obj = {}, A extends Obj = {}> {
+    private readonly spec;
+    private readonly kids;
+    private readonly nodeOf?;
+    constructor(spec: FoldSpec, kids: RoseSpec, nodeOf?: ((env: never, kids: never) => Record<string, TermLike>) | undefined);
+    get name(): string;
+    node(f: (env: P & I, kids: A) => {
+        [k in keyof S]: TermLike;
+    }): RoseFold<P, I, S, A>;
+    private env;
+    private names;
+    private side;
+    private accs;
+    private start;
+    law(name: string, f: (env: P & S) => Cond): Law;
+    get lemmas(): Law[];
+    get fold(): Fold;
+    run(tree: RoseValue<{
+        [k in keyof I]: Raw;
+    }>, params?: {
+        [k in keyof P]?: Raw;
+    }): {
+        [k in keyof S]: number;
+    };
+    crossCheck(laws?: Law[], opts?: {
+        trials?: number;
+        depth?: number;
+        bound?: number;
+        rand?: Rand;
+    }): Agreement;
+}

package/dist/core/dsl.js

@@ -15,7 +15,7 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf } from "./machine.js";
+import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf, pairedArgs } from "./machine.js";
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
 import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
@@ -867,6 +867,7 @@ export class CellsRef {
         return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).each(k => partsOf(this.kind, this.name, f(k))[part])])) };
     }
 }
+const fromOf = (d, p) => (typeof d.from === 'number' ? d.from : d.from(p));
 export class CarriedList {
     name;
     kind;
@@ -874,14 +875,20 @@ export class CarriedList {
     folds;
     map;
     lemmas;
+    params;
+    paramKinds;
     fold;
-    constructor(name, kind, len, folds, map, lemmas = {}) {
+    // `params`: the params' values the folds read (by their kinds: terms for the kernel, constants to encode a request),
+    // undefined where none are given; `paramKinds`, the params themselves, for the lemmas' induction.
+    constructor(name, kind, len, folds, map, lemmas = {}, params, paramKinds = []) {
         this.name = name;
         this.kind = kind;
         this.len = len;
         this.folds = folds;
         this.map = map;
         this.lemmas = lemmas;
+        this.params = params;
+        this.paramKinds = paramKinds;
         this.fold = Object.fromEntries(Object.keys(folds).map(f => [f, map(`${name}$${f}`).at(len)]));
     }
     at(i) { return this.kind.build(this.name, part => this.map(part).at(i)); }
@@ -897,12 +904,21 @@ export class CarriedList {
     equations() {
         const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
         const at = (k) => {
-            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x)));
+            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x, this.p())));
             const below = [...this.kind.invariant(x), ...steps];
-            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k))))] : []));
+            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k, this.p()))))] : []));
         };
         const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
-        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(d.from)), ...(any ? [everyKey(at)] : [])];
+        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(fromOf(d, this.p()))), ...(any ? [everyKey(at)] : [])];
+    }
+    // Whether a fold reads the params (its start a function, or its step taking them).
+    get readsParams() { return Object.values(this.folds).some(d => typeof d.from === 'function' || d.step.length > 2); }
+    p() {
+        if (this.params)
+            return this.params;
+        if (this.readsParams)
+            throw new RangeError(`${this.name}'s folds read the params: give them (encodeInput(values, params))`);
+        return {};
     }
     running(k) { return Object.fromEntries(Object.keys(this.folds).map(f => [f, this.after(f, k)])); }
     // The lemmas, proven: the folds as a machine counting i up from 0 over items that are functions of i known only by
@@ -916,10 +932,11 @@ export class CarriedList {
         const kindFact = this.kind.invariant(this.kind.value(this.name)).length ? { 'every item is a value of its kind': forall(k => all(...this.kind.invariant(item(k)))) } : {};
         const fns = Object.fromEntries(parts.map((p, j) => [fname(p), fn(1, 'x => 0', j === 0 ? { facts: () => kindFact } : {})]));
         const folds = Object.entries(this.folds);
-        const r = rule(`${this.name}'s folds, by induction`).fns(fns).inputs({}).state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.from])) })
-            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i))])) }));
+        const r = rule(`${this.name}'s folds, by induction`).params(Object.fromEntries(this.paramKinds)).fns(fns).inputs({})
+            .state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, typeof d.from === 'number' ? d.from : (p) => d.from(p)])) })
+            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i), env)])) }));
         const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
-        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i))));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))));
     }
     // Every carried map it is kept in: the items' parts, then each fold's.
     get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
@@ -933,13 +950,13 @@ export class CarriedList {
             if (x !== 0)
                 maps[part].set(i, x); });
         for (const [f, d] of Object.entries(this.folds)) {
-            const acc = maps[`${this.name}$${f}`];
-            let value = d.from;
+            const acc = maps[`${this.name}$${f}`], p = this.p();
+            let value = valOf(fromOf(d, p));
             if (value !== 0)
                 acc.set(0, value);
             items.forEach((enc, i) => {
                 const item = this.kind.build(this.name, part => new Term({ op: 'const', value: enc[part] }, enc[part]));
-                const next = valOf(d.step(new Term({ op: 'const', value }, value), item));
+                const next = valOf(d.step(new Term({ op: 'const', value }, value), item, p));
                 if (next === undefined || !Number.isSafeInteger(next) || next < 0)
                     throw new RangeError(`${this.name}'s fold ${f} reads more than its items`);
                 value = next;
@@ -981,6 +998,66 @@ export class ItemsRef {
     within() { return forall(k => this.len.atMost(k).implies(all(...this.names.map(part => this.list(part).at(k).eq(0))))); }
     increasing(by) { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(by(this.at(i)).lt(by(this.at(j))))); }
 }
+export class NodeTable {
+    name;
+    kind;
+    children;
+    folds;
+    size;
+    map;
+    tables;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    constructor(name, kind, children, folds, size, map, tables = {}) {
+        this.name = name;
+        this.kind = kind;
+        this.children = children;
+        this.folds = folds;
+        this.size = size;
+        this.map = map;
+        this.tables = tables;
+    }
+    // The node at n (0, or past the end: the empty tree).
+    node(n) {
+        const index = termAt(n);
+        return { index, empty: index.eq(0), value: this.kind.build(this.name, part => this.map(part).at(index)),
+            fold: Object.fromEntries(Object.keys(this.folds).map(f => [f, this.map(`${this.name}$${f}`).at(index)])),
+            kids: Object.fromEntries(this.children.map(c => [c, this.map(`${this.name}^${c}`).at(index)])) };
+    }
+    at(n) { return this.node(n).value; }
+    // Whether nodes can be made from these children (each 0 or a node already there).
+    fits(kids) { return all(...this.children.map(c => termAt(kids[c]).atMost(this.size))); }
+    // Node size + 1, from a value and children already there, when `when` holds (and they fit): its value, children and
+    // folds written, the size grown.
+    make(value, kids, when = yes) {
+        const n = this.size.plus(1), go = when.and(this.fits(kids)), parts = partsOf(this.kind, this.name, value);
+        const val = this.kind.build(this.name, part => termAt(parts[part]));
+        const kidRefs = Object.fromEntries(this.children.map(c => [c, this.node(termAt(kids[c]))]));
+        const writes = {};
+        const put = (part, x) => { writes[part] = this.map(part).set(n, when_(go, x, this.map(part).at(n))); };
+        for (const part of this.kind.vars(this.name))
+            put(part, parts[part]);
+        for (const c of this.children)
+            put(`${this.name}^${c}`, kids[c]);
+        for (const [f, d] of Object.entries(this.folds))
+            put(`${this.name}$${f}`, d.node(val, kidRefs, this.tables));
+        return { [this.name]: { parts: writes }, [`${this.name}_size`]: when_(go, n, this.size) };
+    }
+    // The table's own laws: every node's children are earlier nodes and its folds are its children's, and node 0 and every
+    // key past the end hold nothing (each fold's empty).
+    laws() {
+        const inside = (k) => k.atLeast(1).and(k.atMost(this.size));
+        const folds = Object.entries(this.folds);
+        return [
+            ...(this.children.length ? [[`every ${this.name} node's children are earlier nodes`, forall(k => inside(k).implies(all(...this.children.map(c => this.node(k).kids[c].lt(k)))))]] : []),
+            ...(folds.length ? [[`every ${this.name} node's folds are its children's`, forall(k => inside(k).implies(all(...folds.map(([f, d]) => {
+                        const x = this.node(k);
+                        return x.fold[f].eq(d.node(x.value, Object.fromEntries(this.children.map(c => [c, this.node(x.kids[c])])), this.tables));
+                    }))))]] : []),
+            [`nothing in ${this.name} past its end`, forall(k => k.eq(0).or(this.size.lt(k)).implies(all(...this.kind.vars(this.name).map(part => this.map(part).at(k).eq(0)), ...this.children.map(c => this.node(k).kids[c].eq(0)), ...folds.map(([f, d]) => this.node(k).fold[f].eq(d.empty)))))],
+        ];
+    }
+}
+const termAt = (t) => (t instanceof Term ? t : lit(t));
 // A law about every key of a map: proven at a fresh key, assumed at the keys a step reads.
 // With two parameters or more, about every two keys or more: forall((i, j) => i.lt(j).implies(...)).
 export function forall(f) { return { forall: f }; }
@@ -1194,6 +1271,8 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         if (!plain.test(n) || reservedInRecur.includes(n) || n === name)
             throw new Error(`recur ${name}: ${n} can't name an argument or a function here (${reservedInRecur.join(', ')} and ${name} are taken)`);
     distinctNames(`recur ${name}`, [...args, ...uses.map(([u]) => u)]);
+    // A rule reads the function at its arguments paired, which the kernel multiplies out: with five further arguments that
+    // is a polynomial of degree 32, past what it can hold.
     if (args.length > 4)
         throw new Error(`recur ${name}: at most four further arguments`);
     const named = (n) => new Term({ op: 'var', name: n });
@@ -1244,8 +1323,9 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
     const keysOf = (n) => (f) => {
         if (n === 0)
             return f();
-        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d),
-            (a, b, c, d, e) => f(a, b, c, d, e), (a, b, c, d, e, g) => f(a, b, c, d, e, g)][n - 1];
+        // A law's keys are counted by its callback's parameters: this one takes n.
+        const by = (...ks) => f(...ks);
+        Object.defineProperty(by, 'length', { value: n });
         return forall(by);
     };
     const facts = (withBetween) => (f, at = {}) => {
@@ -1279,7 +1359,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
 };
 const distinctNames = (what, names) => { if (new Set(names).size !== names.length)
     throw new Error(`${what}: a name given twice`); };
-// A recurrence as JavaScript: a function of its arguments, the functions it reads inlined (each as a function of its key,
+// A recurrence as JavaScript: a function of its arguments, the functions it reads inlined (each called on its arguments,
 // as the runtimes call it).
 const recurJs = (name, args, zero, next, uses) => {
     const fns = new Map(uses.map(([u], i) => [u, `$f${i}`]));
@@ -1294,7 +1374,10 @@ const recurJs = (name, args, zero, next, uses) => {
             case 'min': return `Math.min(${js(e.a)}, ${js(e.b)})`;
             case 'max': return `Math.max(${js(e.a)}, ${js(e.b)})`;
             case 'if': return `(${jc(e.c)} ? ${js(e.then)} : ${js(e.else)})`;
-            case 'get': return `${fns.get(e.map)}(${js(e.key)})`;
+            case 'get': {
+                const i = uses.findIndex(([u]) => u === e.map), args = uses[i][1].arity > 1 ? pairedArgs(e.key, uses[i][1].arity) : undefined;
+                return args ? `$g${i}(${args.map(js).join(', ')})` : `${fns.get(e.map)}(${js(e.key)})`;
+            }
         }
     };
     const jc = (c) => {
@@ -1309,7 +1392,7 @@ const recurJs = (name, args, zero, next, uses) => {
             case 'all': throw new Error('a recurrence takes no flag or quantifier');
         }
     };
-    const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); `).join('');
+    const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); ${d.arity > 1 ? `const $g${i} = (${jsOf(d)}); ` : ''}`).join('');
     // The last value computed at each tuple of further arguments is kept, so reading f at x after f at a smaller x takes
     // only the steps between (a rule that reads f at a count that grows costs one step a request).
     return `(() => { ${inlined}const $memo = new Map(); return (x, ${args.map(a => `${a}, `).join('')}) => { const $k = ${args.length ? `[${args.join(', ')}].join()` : "''"}; let $at = $memo.get($k); if (!$at || $at[0] > x) $at = [0, ${js(zero)}]; let x0 = $at[0], prev = $at[1]; for (; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } if ($memo.size > 4096) $memo.clear(); $memo.set($k, [x, prev]); return prev; }; })()`;
@@ -1322,8 +1405,9 @@ const flatFns = (defs) => defs.flatMap(([n, d]) => {
 const pairE = (a, b) => { const s = { op: 'add', a, b }; return { op: 'add', a: { op: 'prod', a: s, b: s }, b }; };
 const argsKey = (args) => args.slice(1).reduce(pairE, args[0]);
 // A function's JavaScript as one function of its key: its arguments unpaired (left-nested, as argsKey pairs them).
+const jsOf = (d) => (typeof d.js === 'string' ? d.js : String(d.js));
 const fnSource = (name, d) => {
-    const src = typeof d.js === 'string' ? d.js : String(d.js);
+    const src = jsOf(d);
     let f;
     try {
         f = compileFunction([], `return (${src})`)();
@@ -1446,6 +1530,19 @@ export class Rule {
         return this.with({ maps: [...this.spec.maps, ...entries.flatMap(([n, k]) => k.vars(n).map(part => [part, 0]))],
             state: [...this.spec.state, ...entries.map(([n]) => [`${n}_len`, 0])], items: [...(this.spec.items ?? []), ...entries] });
     }
+    // A table of nodes, empty at the start (NodeTable): a tree in the state, made one node a step.
+    nodes(name, of, children, folds = {}) {
+        for (const c of children)
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(c) || c === 'value')
+                throw new Error(`${name}: ${c} can't name a child`);
+        for (const f of Object.keys(folds))
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                throw new Error(`${name}: ${f} is not a plain fold name`);
+        distinctNames(name, [...children]);
+        const maps = [...of.vars(name).map(part => [part, 0]), ...children.map(c => [`${name}^${c}`, 0]),
+            ...Object.entries(folds).map(([f, d]) => [`${name}$${f}`, d.empty])];
+        return this.with({ maps: [...this.spec.maps, ...maps], state: [...this.spec.state, [`${name}_size`, 0]], nodes: [...(this.spec.nodes ?? []), [name, of, [...children], folds]] });
+    }
     // Functions defined outside the rule (fn, divBy, modBy), read like params that take arguments: f(x).
     fns(defs) {
         return this.with({ fns: [...(this.spec.fns ?? []), ...Object.entries(defs)] });
@@ -1456,6 +1553,7 @@ export class Rule {
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
     // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
     //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
+    // Each fold's start and step, and each lemma, may read the params declared before it.
     carriesList(name, of, folds = {}, lemmas = {}) {
         const entries = [[name, of, folds, lemmas]];
         for (const [n, , fs] of entries)
@@ -1464,7 +1562,7 @@ export class Rule {
                     throw new Error(`${n}: ${f} is not a plain fold name`);
         // The folds' lemmas, proven now (a lemma that isn't throws, with the verdict).
         for (const [n, k, fs, ls] of entries) {
-            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls).prove();
+            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, undefined, this.spec.params).prove();
             if (!(v2.proven && v2.checked))
                 throw new Unproven(`${n}'s fold lemmas`, v2);
         }
@@ -1530,6 +1628,12 @@ export class Rule {
             if (k.invariant(k.value(n)).length) {
                 out.push(this.law(`every ${n} cell is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
             }
+        for (const [n, k] of this.spec.nodes ?? []) {
+            if (k.invariant(k.value(n)).length)
+                out.push(this.law(`every ${n} node is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
+            for (const [name] of this.env({ flags: false, inputs: false, queries: false })[n].laws())
+                out.push(this.law(name, env => of(env, n).laws().find(([m]) => m === name)[1]));
+        }
         return out;
     }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
@@ -1547,7 +1651,7 @@ export class Rule {
         const [k1, more] = keysFor(out), c = out.forall(v(k1), ...more.map(v)).c;
         return withSource(more.length ? { name, forall: k1, keys: more, then: c, ...w } : { name, forall: k1, then: prenex(c, `step law ${name}`, k1) ?? c, ...w }, src);
     }
-    // A law about k steps in a row (k from 2 to 16): `then(first, last, requests)` relates what the first step reads to the
+    // A law about k steps in a row (k from 2 to 64): `then(first, last, requests)` relates what the first step reads to the
     // state, maps and sums after the last, with each step's request and queries (requests[0] is the first's); `when(before,
     // j)` narrows the j-th step's request (j from 0), read at the state that step starts from.
     //   meter.stepsLaw('two requests spend at most 2m', 2, ({spent, m}, after) => after.spent.atMost(spent.plus(m).plus(m)))
@@ -1649,8 +1753,9 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            const ps = Object.fromEntries(this.spec.params.map(([n]) => [n, out[n]]));
             for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
-                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls);
+                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, ps, this.spec.params);
                 for (const part of l.maps)
                     delete out[part];
                 out[n] = l;
@@ -1697,6 +1802,15 @@ export class Rule {
                 delete out[part];
             out[n] = new ItemsRef(n, k, len(n), part => new ListRef(at(part), len(n)));
         }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const tables = {};
+        for (const [n, k, cs, fs] of this.spec.nodes ?? []) {
+            const t = new NodeTable(n, k, cs, fs, v(at(`${n}_size`)), part => new MapRef(at(part), init.get(part)), { ...tables });
+            tables[n] = t;
+            for (const part of [...k.vars(n), ...cs.map(c => `${n}^${c}`), ...Object.keys(fs).map(f => `${n}$${f}`)])
+                delete out[part];
+            out[n] = t;
+        }
     }
     // Every name the rule declares is declared once (a flag named again replaces the earlier one, so flags are checked as
     // they are defined): an input and a state variable sharing a name would hand the callbacks only one of them.
@@ -1705,6 +1819,7 @@ export class Rule {
         return [...s.params.map(([n]) => [n, 'a param']), ...(s.fns ?? []).map(([n]) => [n, 'a function']), ...s.inputs.map(([n]) => [n, 'an input']), ...(s.carried ?? []).map(n => [n, 'a carried map']),
             ...s.state.map(([n]) => [n, 'a state variable']), ...s.maps.map(([n]) => [n, 'a map']), ...s.sums.map(([n]) => [n, 'a sum']), ...s.queries.map(([n]) => [n, 'a query']),
             ...[...(s.cells ?? []), ...(s.items ?? [])].filter(([n, k]) => !k.vars(n).includes(n)).map(([n]) => [n, 'a map of a kind']),
+            ...(s.nodes ?? []).map(([n]) => [n, 'a table of nodes']),
         ];
     }
     whatIs(n) { return this.names().find(([m]) => m === n)?.[1] ?? 'something else'; }
@@ -1770,7 +1885,7 @@ export class Rule {
         // Functions, and their facts: each function's own (named after it), then the rule's.
         // The functions a function reads come first, each named <function>.<use>.
         const flat = flatFns(s.fns ?? []);
-        const fns = Object.fromEntries(flat.map(([n, d]) => [n, { js: fnSource(n, d), ...(d.lean ? { lean: d.lean } : {}), ...(d.recur ? { recur: d.recur } : {}) }]));
+        const fns = Object.fromEntries(flat.map(([n, d]) => [n, { js: fnSource(n, d), ...(d.arity > 1 ? { arity: d.arity, call: jsOf(d) } : {}), ...(d.lean ? { lean: d.lean } : {}), ...(d.recur ? { recur: d.recur } : {}) }]));
         const facts = [
             ...flat.flatMap(([n, d, uses]) => Object.entries(d.facts?.(fnTerm(n, d), uses) ?? {}).map(([name, f]) => this.lawOf(`${n}: ${name}`, f))),
             ...(s.facts ?? []).flatMap(f => Object.entries(f(pEnv)).map(([name, out]) => this.lawOf(name, out))),
@@ -1837,7 +1952,7 @@ export class Rule {
                 }
                 if (d === (opts.depth ?? 8))
                     break;
-                const input = this.randomInput(rand, bound);
+                const input = this.randomInput(rand, bound, params);
                 if (s.prune || !allowed(m, run, params, st, input))
                     continue;
                 d++;
@@ -1961,7 +2076,7 @@ export class Rule {
             const edges = trial === 0 ? opts.edges ?? [] : [];
             for (let d = 0; d < (opts.depth ?? 10) + edges.length; d++) {
                 const request = edges[d] ?? opts.draw?.(rand) ?? sample(s.inputs);
-                ours = gen.step(ps, ours, this.encodeInput(request));
+                ours = gen.step(ps, ours, this.encodeInput(request, params));
                 theirs = reference.step(params, theirs, request);
                 const got = this.decode(ours);
                 for (const [field, want] of Object.entries(theirs)) {
@@ -1977,10 +2092,12 @@ export class Rule {
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
     // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
-    // A carried list is an array of its items' runtime values (its length and folds computed from them).
+    // A carried list is an array of its items' runtime values (its length and folds computed from them); `params`, what
+    // folds that read the params are computed with.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    encodeInput(values) {
-        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(values[n])]));
+    encodeInput(values, params) {
+        const at = params && this.paramValues(this.encodeParams(params));
+        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, at).encode(values[n])]));
         const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
         for (const l of Object.values(lists))
             Object.assign(out, l.maps);
@@ -1994,13 +2111,18 @@ export class Rule {
     }
     // Random params and inputs that meet their kinds (not the user's `pre` or `assume`, which a caller checks).
     randomParams(rand, bound) { return Object.assign({}, ...this.spec.params.map(([n, k]) => k.random(n, rand, bound))); }
-    randomInput(rand, bound) {
+    // The params' values by their kinds, as constants (what a fold that reads them is computed with).
+    paramValues(ps) {
+        return Object.fromEntries(this.spec.params.map(([n, k]) => [n, k.build(n, part => new Term({ op: 'const', value: ps[part] }, ps[part]))]));
+    }
+    // `ps`: the params (encoded), for folds that read them.
+    randomInput(rand, bound, ps) {
         const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
         for (const n of this.spec.carried ?? [])
             out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
         // A carried list: items drawn by their kind, its length and folds as the encoding computes them.
         for (const [n, k, fs] of this.spec.lists2 ?? []) {
-            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
+            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, ps && this.paramValues(ps)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
             Object.assign(out, l.maps, { [`${n}_len`]: l.len });
         }
         return out;
@@ -2022,6 +2144,11 @@ export class Rule {
         }
         for (const [n, k] of this.spec.items ?? [])
             out[n] = Array.from({ length: st.scalars[`${n}_len`] }, (_, i) => cell(n, k, i));
+        // A table of nodes: node 1 first, each its value and its children.
+        for (const [n, k, cs] of this.spec.nodes ?? []) {
+            const at = (part, key) => st.maps[part]?.get(key) ?? 0;
+            out[n] = Array.from({ length: st.scalars[`${n}_size`] }, (_, i) => ({ value: cell(n, k, i + 1), ...Object.fromEntries(cs.map(c => [c, at(`${n}^${c}`, i + 1)])) }));
+        }
         return out;
     }
     // The prune order's variable, if the history is pruned (a runtime must send it nondecreasing).
@@ -2105,7 +2232,7 @@ export class Fun {
         this.compiledRule ??= (rule => ({ rule, gen: rule.compiled() }))(this.rule);
         const { rule, gen } = this.compiledRule, ps = rule.encodeParams(params);
         const kinds = Object.entries(this.result(this.r['env']({ flags: false, state: false, queries: false })));
-        const st = rule.decode(gen.step(ps, gen.init(ps), rule.encodeInput(values)));
+        const st = rule.decode(gen.step(ps, gen.init(ps), rule.encodeInput(values, params)));
         return Object.fromEntries(kinds.map(([k]) => [k, st[`out.${k}`]]));
     }
 }
@@ -2212,7 +2339,7 @@ export function crossCheckDecision(d, opts = {}) {
     const r = d.rule, m = r.machine, bound = opts.bound ?? 4, rand = opts.rand ?? seeded(11), own = d.given.slice(d.given.length - src.own);
     let checked = 0;
     for (let i = 0; i < (opts.trials ?? 500); i++) {
-        const input = r.randomInput(rand, bound), values = { ...r.randomParams(rand, bound), ...numbersOf(input) };
+        const ps = r.randomParams(rand, bound), input = r.randomInput(rand, bound, ps), values = { ...ps, ...numbersOf(input) };
         const st = { scalars: {}, maps: Object.fromEntries(Object.entries(input).filter((e) => typeof e[1] !== 'number').map(([n, cells]) => [n, new Map(cells)])) };
         const keys = exactKeys(keysOf(bound, st), values, st);
         const sc = { vars: values, maps: Object.fromEntries(Object.entries(st.maps).map(([n, cells]) => [n, { cells, dflt: 0 }])), keys, flags: {} };
@@ -2243,6 +2370,11 @@ export class FoldRule {
     assume(f) { return this.with({ assume: [...this.spec.assume, f] }); }
     leaf(f) { return this.with({ leaf: f }); }
     node(f) { return this.with({ node: f }); }
+    // Nodes with any number of children (RoseFold): the children's values folded into `kids`, from `from` by `step` (which
+    // reads the params), each lemma a law of every prefix of every node's children that meet the fold's laws.
+    children(from, step, lemmas = {}) {
+        return new RoseFold(this.spec, { from: from, step: step, lemmas: lemmas });
+    }
     env(inputs = true) {
         const out = {};
         for (const [n, k] of this.spec.params)
@@ -2337,4 +2469,151 @@ export class FoldRule {
     }
 }
 export const fold = (name) => new FoldRule({ name, params: [], inputs: [], pre: [], assume: [] });
-export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, laws));
+// A fold's laws proven over every tree (a rose fold's own laws, its children's lemmas, with them).
+export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, [...(f.lemmas ?? []), ...laws]));
+const asTerm = (t) => (t instanceof Term ? t : lit(t));
+// A fold over trees whose nodes have any number of children, as the kernel's binary fold (so the kernel and Lean's
+// fold_sound check it as they check any fold): a node's children become a chain of glue nodes, each folding one child
+// into the values of the rest (`kids`, from `from` at the chain's end), and the node reads the chain's values. Every
+// tree node carries `kind$` (0 a node or leaf of the tree, 1 a glue node or the chain's end) and its role as an input; a
+// law of the fold is claimed where kind$ is 0, each lemma where it is 1. A binary tree no rose tree maps to (a child
+// where a chain belongs, or a chain where a child does) is read as one that does: a node reads a chain only, a glue
+// node a child only, so the laws are proven of every binary tree, and of each rose tree's image in particular.
+//   fold('org chart').params({cap: nat}).inputs({pay: nat})
+//     .leaf(({pay}) => ({cost: pay, heads: 1}))
+//     .children({cost: 0, heads: 0}, (acc, kid) => ({cost: acc.cost.plus(kid.cost), heads: acc.heads.plus(kid.heads)}))
+//     .node(({pay}, kids) => ({cost: kids.cost.plus(pay), heads: kids.heads.plus(1)}))
+export class RoseFold {
+    spec;
+    kids;
+    nodeOf;
+    constructor(spec, kids, nodeOf) {
+        this.spec = spec;
+        this.kids = kids;
+        this.nodeOf = nodeOf;
+    }
+    get name() { return this.spec.name; }
+    node(f) { return new RoseFold(this.spec, this.kids, f); }
+    env(inputs = true) {
+        const out = {};
+        for (const [n, k] of this.spec.params)
+            out[n] = k.value(n);
+        if (inputs)
+            for (const [n, k] of this.spec.inputs)
+                out[n] = k.value(n);
+        return out;
+    }
+    names() {
+        if (!this.spec.leaf)
+            throw new Error(`${this.spec.name}: a fold needs a leaf`);
+        return Object.keys(this.spec.leaf(this.env()));
+    }
+    side(prefix) { return Object.fromEntries(this.names().map(n => [n, v(`${prefix}${n}`)])); }
+    accs(prefix) { return Object.fromEntries(Object.keys(this.kids.from).map(a => [a, v(`${prefix}kids$${a}`)])); }
+    start(p) { return Object.fromEntries(Object.entries(this.kids.from).map(([a, x]) => [a, typeof x === 'number' ? lit(x) : asTerm(x(p))])); }
+    // A law about the values and the params, claimed of every node and leaf of the tree.
+    law(name, f) { return { name, holds: v('kind$').atLeast(1).or(f({ ...this.env(false), ...this.side('') })).c }; }
+    // The children's lemmas (claimed of every glue node), and that kind$ is 0 or 1: proveFold adds them.
+    get lemmas() {
+        const p = this.env(false);
+        return [{ name: `${this.spec.name}: kind$ is 0 or 1`, holds: v('kind$').atMost(1).c },
+            ...Object.entries(this.kids.lemmas).map(([n, l]) => ({ name: n, holds: v('kind$').eq(0).or(l(this.accs(''), p)).c }))];
+    }
+    get fold() {
+        const s = this.spec, node = this.nodeOf;
+        if (!s.leaf || !node)
+            throw new Error(`${s.name}: a fold needs a leaf and a node`);
+        const env = this.env(), pEnv = this.env(false), names = this.names(), accNames = Object.keys(this.kids.from);
+        const role = v('role$'), real = role.eq(0);
+        const pre = [...s.params.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.pre.map(f => f(pEnv).c)];
+        const own = all(...s.inputs.flatMap(([n, k]) => k.assume(n)), ...s.assume.map(f => f(env)));
+        const assume = role.atMost(1).and(role.eq(1).or(own)).c;
+        const start = this.start(pEnv);
+        // A leaf of the tree, or the end of a chain (no children yet).
+        const leafOut = s.leaf(env);
+        const leaf = { ...Object.fromEntries(names.map(n => [n, when(real, leafOut[n], 0).e])),
+            ...Object.fromEntries(accNames.map(a => [`kids$${a}`, when(real, 0, start[a]).e])), 'kind$': when(real, 0, 1).e };
+        // A node reads the chain on its left (its children's values); a glue node folds its left child into the rest.
+        const lAcc = this.accs('l_'), rAcc = this.accs('r_'), lk = v('l_kind$'), rk = v('r_kind$');
+        const kidsIn = Object.fromEntries(accNames.map(a => [a, when(lk.eq(1), lAcc[a], start[a])]));
+        const rest = Object.fromEntries(accNames.map(a => [a, when(rk.eq(1), rAcc[a], start[a])]));
+        const nodeOut = node(env, kidsIn), stepped = this.kids.step(rest, this.side('l_'), pEnv);
+        const nodeE = { ...Object.fromEntries(names.map(n => [n, when(real, nodeOut[n], 0).e])),
+            ...Object.fromEntries(accNames.map(a => [`kids$${a}`, when(real, 0, when(lk.eq(0), stepped[a], rest[a])).e])), 'kind$': when(real, 0, 1).e };
+        return { name: s.name, params: s.params.flatMap(([n, k]) => k.vars(n)), inputs: [...s.inputs.flatMap(([n, k]) => k.vars(n)), 'role$'], leaf, node: nodeE,
+            ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}), assume };
+    }
+    // The values of a rose tree, by the terms proven (the tree as the binary tree the fold reads it as).
+    run(tree, params = {}) {
+        const f = this.fold, ps = encode(this.spec.params, params), none = { name: f.name, params: [], inputs: [], state: {}, step: {} };
+        const st = { scalars: {}, maps: {} };
+        if (f.pre && !evalC(f.pre, ps, st, none))
+            throw new RangeError(`${f.name}: the params don't meet its precondition`);
+        const zero = Object.fromEntries(f.inputs.map(n => [n, 0]));
+        const at = (exprs, env) => Object.fromEntries(Object.entries(exprs).map(([n, e]) => [n, evalE(e, env, st, none)]));
+        const kidsOf = (vals, prefix) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [`${prefix}${n}`, x]));
+        const chain = (cs) => {
+            const env = { ...ps, ...zero, 'role$': 1 };
+            if (!cs.length)
+                return at(f.leaf, env);
+            return at(f.node, { ...env, ...kidsOf(go(cs[0]), 'l_'), ...kidsOf(chain(cs.slice(1)), 'r_') });
+        };
+        const go = (t) => {
+            const own = 'leaf' in t ? t.leaf : t.node, env = { ...ps, ...encode(this.spec.inputs, own), 'role$': 0 };
+            if (f.assume && !evalC(f.assume, env, st, none))
+                throw new RangeError(`${f.name}: ${JSON.stringify(own)} doesn't meet its assumption`);
+            if ('leaf' in t)
+                return at(f.leaf, env);
+            return at(f.node, { ...env, ...kidsOf(chain(t.children), 'l_'), ...kidsOf(chain([]), 'r_') });
+        };
+        const out = go(tree);
+        return Object.fromEntries(this.names().map(n => [n, out[n]]));
+    }
+    // The builders against what they built, on random rose trees: each value by the callbacks' own arithmetic (the
+    // children folded by step, then the node) against the terms proven, and each law and lemma at the root.
+    crossCheck(laws = [], opts = {}) {
+        const s = this.spec, rand = opts.rand ?? seeded(17), bound = opts.bound ?? 6, f = this.fold;
+        let checked = 0;
+        const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
+        const tree = (d) => (d === 0 || rand(3) === 0 ? { leaf: sample(s.inputs) } : { node: sample(s.inputs), children: Array.from({ length: rand(4) }, () => tree(d - 1)) });
+        const known = (vals) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [n, new Term({ op: 'const', value: x }, x)]));
+        const nums = (out) => { const vals = Object.entries(out).map(([n, x]) => [n, valOf(x)]); return vals.every(([, x]) => x !== undefined) ? Object.fromEntries(vals) : undefined; };
+        for (let t = 0; t < (opts.trials ?? 200); t++) {
+            const params = sample(s.params), ps = encode(s.params, params);
+            const pv = known(ps), pEnv = Object.fromEntries(s.params.map(([n, k]) => [n, k.build(n, part => pv[part])]));
+            const builder = (tr) => {
+                const own = 'leaf' in tr ? tr.leaf : tr.node, iv = known(encode(s.inputs, own)), env = { ...pEnv, ...Object.fromEntries(s.inputs.map(([n, k]) => [n, k.build(n, part => iv[part])])) };
+                if ('leaf' in tr)
+                    return nums(s.leaf(env));
+                let acc = nums(this.start(pEnv));
+                for (const c of [...tr.children].reverse()) {
+                    const kid = builder(c);
+                    acc = acc && kid && nums(this.kids.step(known(acc), known(kid), pEnv));
+                }
+                return acc && nums(this.nodeOf(env, known(acc)));
+            };
+            const tr = tree(opts.depth ?? 3);
+            let ours;
+            try {
+                ours = this.run(tr, params);
+            }
+            catch {
+                continue;
+            }
+            const theirs = builder(tr);
+            if (!theirs)
+                continue;
+            for (const [n, x] of Object.entries(theirs)) {
+                checked++;
+                if (ours[n] !== x)
+                    return { checked, failure: `${f.name}: ${n} is ${x} by its callbacks, ${ours[n]} by the terms proven, for ${JSON.stringify(tr)}` };
+            }
+            for (const law of laws) {
+                checked++;
+                if (!evalC(law.holds, { ...ps, ...ours, 'kind$': 0 }, { scalars: {}, maps: {} }, { name: f.name, params: [], inputs: [], state: {}, step: {} }))
+                    return { checked, failure: `${f.name}: law ${law.name} fails for ${JSON.stringify(tr)} with params ${JSON.stringify(params)}` };
+            }
+        }
+        return { checked };
+    }
+}

package/dist/core/gdp.js

@@ -21,7 +21,7 @@ export function guard(prover, fn, field, opts) {
     if (m.pre && !evalC(m.pre, ps, { scalars: {}, maps: {} }, m))
         throw new Error(`${fn.name}: the params ${JSON.stringify(params)} don't meet its precondition`);
     return (args, ...about) => {
-        const input = r.encodeInput(args);
+        const input = r.encodeInput(args, params);
         if (m.assume && !evalC(m.assume, { ...ps, ...input }, { scalars: {}, maps: {} }, m))
             return null;
         return atPath(fn.run(args, params), field) === true ? prover.prove(...about) : null;
@@ -46,7 +46,7 @@ export function gate(prover, r, flag, opts) {
     let st = opts.state ?? compiled.init(ps);
     return {
         request: (args, ...about) => {
-            const input = r.encodeInput(args);
+            const input = r.encodeInput(args, params);
             if (!allowed(m, run, ps, st, input))
                 return null;
             const granted = requestEnv(m, run, ps, st, input)[`?${flag}`] === 1;

package/dist/core/machine.d.ts

@@ -71,6 +71,8 @@ export type Fn = {
     js: string;
     lean?: string;
     recur?: Recurrence;
+    arity?: number;
+    call?: string;
 };
 export type Recurrence = {
     args: string[];
@@ -162,6 +164,7 @@ export type Request = Record<string, number | ReadonlyMap<number, number>>;
 export declare const naturalIn: (v: unknown, what: string) => number;
 export declare function evalE(e: E, env: Env, st: State, m: Machine): number;
 export declare const fnValue: (fn: Fn, key: number) => number;
+export declare function pairedArgs(key: E, n: number): E[] | undefined;
 export declare function evalC(c: C, env: Env, st: State, m: Machine): boolean;
 export declare function carriedView(m: Machine, st: State, input: Request, rename?: (map: string) => string): State;
 export declare const numbersOf: (input: Request) => Record<string, number>;

package/dist/core/machine.js

@@ -130,7 +130,12 @@ export function evalE(e, env, st, m) {
         case 'max': return Math.max(evalE(e.a, env, st, m), evalE(e.b, env, st, m));
         case 'if': return evalC(e.c, env, st, m) ? evalE(e.then, env, st, m) : evalE(e.else, env, st, m);
         case 'get': {
-            const key = evalE(e.key, env, st, m), fn = m.fns?.[e.map];
+            const fn = m.fns?.[e.map], args = fn?.call ? pairedArgs(e.key, fn.arity) : undefined;
+            if (args) {
+                const xs = args.map(a => evalE(a, env, st, m));
+                return naturalIn(callOf(fn)(...xs), `${e.map}(${xs.join(', ')})`);
+            }
+            const key = evalE(e.key, env, st, m);
             return fn ? naturalIn(fnOf(fn)(key), `${e.map}(${key})`) : st.maps[e.map].get(key) ?? st.defaults?.[e.map] ?? m.maps[e.map];
         }
     }
@@ -147,6 +152,34 @@ const fnOf = (fn) => {
     }
     return f;
 };
+const compiledCalls = new WeakMap();
+const callOf = (fn) => {
+    let f = compiledCalls.get(fn);
+    if (!f) {
+        f = compileFunction([], `return (${fn.call})`)();
+        compiledCalls.set(fn, f);
+    }
+    return f;
+};
+// The n arguments a key pairs (left-nested, ((a, b), c)..., each pair (s)² + b with s = a + b), if it is their pairing.
+const paired = new WeakMap();
+export function pairedArgs(key, n) {
+    let byN = paired.get(key);
+    if (!byN)
+        paired.set(key, (byN = new Map()));
+    if (byN.has(n))
+        return byN.get(n);
+    let out;
+    if (n === 1)
+        out = [key];
+    else if (key.op === 'add' && key.a.op === 'prod' && key.a.a.op === 'add' && alike(key.a.a, key.a.b) && alike(key.a.a.b, key.b)) {
+        const first = pairedArgs(key.a.a.a, n - 1);
+        out = first && [...first, key.b];
+    }
+    byN.set(n, out);
+    return out;
+}
+const alike = (a, b) => a === b || JSON.stringify(a) === JSON.stringify(b);
 export function evalC(c, env, st, m) {
     switch (c.op) {
         case '<': return evalE(c.a, env, st, m) < evalE(c.b, env, st, m);
@@ -323,7 +356,12 @@ export function compileJs(m) {
             case 'min': return `Math.min(${ex(e.a)}, ${ex(e.b)})`;
             case 'max': return `Math.max(${ex(e.a)}, ${ex(e.b)})`;
             case 'if': return `(${cx(e.c)} ? ${ex(e.then)} : ${ex(e.else)})`;
-            case 'get': return fns.includes(e.map) ? `$n(fn${fns.indexOf(e.map)}(${ex(e.key)}), ${id(`${e.map}()`)})` : `(maps[${id(e.map)}].get(${ex(e.key)}) ?? ${carriedMaps.includes(e.map) ? '0' : `dft[${id(e.map)}] ?? ${plain.maps[e.map]}`})`;
+            case 'get': {
+                const fn = m.fns?.[e.map], args = fn?.call ? pairedArgs(e.key, fn.arity) : undefined;
+                if (args)
+                    return `$n(fnc${fns.indexOf(e.map)}(${args.map(ex).join(', ')}), ${id(`${e.map}()`)})`;
+                return fns.includes(e.map) ? `$n(fn${fns.indexOf(e.map)}(${ex(e.key)}), ${id(`${e.map}()`)})` : `(maps[${id(e.map)}].get(${ex(e.key)}) ?? ${carriedMaps.includes(e.map) ? '0' : `dft[${id(e.map)}] ?? ${plain.maps[e.map]}`})`;
+            }
         }
     };
     const cx = (c) => {
@@ -379,7 +417,7 @@ function $n(v, what) { if (typeof v !== 'number' || !Number.isSafeInteger(v) ||
 function $x(v) { if (v > 9007199254740991) throw new RangeError('a value passed 2^53 - 1, past which the proofs over the naturals no longer describe the run'); return v; }
 function $m(v, what) { if (!(v instanceof Map)) throw new RangeError(what + ' must be a Map of naturals'); for (const [key, x] of v) { $n(key, 'a key of ' + what); $n(x, 'a cell of ' + what); } return v; }
 function $keys(maps, names) { const keys = new Set(); let past = 0; for (const c of Object.values(maps)) for (const key of c.keys()) past = Math.max(past, key + 1); for (const n of names) for (const key of maps[n].keys()) keys.add(key); return [...keys, past]; }
-${fns.map((name, i) => `const fn${i} = (${m.fns[name].js});\n`).join('')}function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }
+${fns.map((name, i) => `const fn${i} = (${m.fns[name].js});\n${m.fns[name].call ? `const fnc${i} = (${m.fns[name].call});\n` : ''}`).join('')}function $breaks(maps, reads, cmps) { const p = new Set([0]); for (const [n, d, minus] of reads) { for (const s of maps[n].keys()) { if (minus) p.add(s + d); else if (s >= d) p.add(s - d); } if (minus) p.add(d); } for (const [v, d, minus] of cmps) { if (minus) { p.add(v + d); p.add(d); } else if (v >= d) p.add(v - d); } const keys = new Set(); for (const q of p) for (let i = -1; i <= 2; i++) if (q + i >= 0) keys.add(q + i); const sorted = [...keys].sort((a, b) => a - b); sorted.push(sorted[sorted.length - 1] + 1); return sorted; }
 function $dense(keys, f) { const top = keys[keys.length - 1]; if (top > 1000000) throw new RangeError('a write at every key reads its key in arithmetic past a million keys (' + top + ')'); const d = f(top), cells = new Map(); for (let k = 0; k < top; k++) { const v = f(k); if (v !== d) cells.set(k, v); } return {cells, d}; }
 function $every(keys, f) { const past = keys[keys.length - 1], d = f(past), cells = new Map(); for (let i = 0; i < keys.length - 1; i++) { const v = f(keys[i]); if (v !== d) cells.set(keys[i], v); } return {cells, d}; }
 export function init(params) {

package/dist/kernel/kernel.js

@@ -1042,8 +1042,9 @@ export function stepLawObligations(machine, laws, instances, sl) {
     const m = machine.history ? historyMachine(machine).machine : machine;
     scope(m, laws);
     const k = sl.steps ?? 1;
-    if (!Number.isInteger(k) || k < 1 || k > 16)
-        throw new Error(`step law ${sl.name}: steps is a whole number from 1 to 16`);
+    // Past 64 the cost is the bound (proving grows about as k³: 64 steps in about 90 s; Lean checks 32 in about 13 minutes).
+    if (!Number.isInteger(k) || k < 1 || k > 64)
+        throw new Error(`step law ${sl.name}: steps is a whole number from 1 to 64`);
     const whens = sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when];
     if (whens.length > k)
         throw new Error(`step law ${sl.name}: one when per step at most`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gdp-wired",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "An automatic prover for stateful rules (budgets, caps, windows, workflows, policies): laws proven with no proof to write, checked again in Lean, counterexamples found on the GPU, the rule shipped as code",
   "keywords": [
     "verification",
@@ -89,7 +89,7 @@
     "build": "bun scripts/build.ts",
     "prepublishOnly": "bun scripts/build.ts",
     "smoke": "sh scripts/smoke.sh",
-    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts invoices.test.ts folds.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
+    "test": "bun scripts/gen-lean-library.ts --check && cd core && bun test solver.test.ts dsl.test.ts conformance.test.ts compose.test.ts quantifiers.test.ts functions.test.ts keyterms.test.ts lists.test.ts liveness.test.ts sizes.test.ts values.test.ts builders.test.ts gdp.test.ts datatypes.test.ts lemmas.test.ts invoices.test.ts folds.test.ts trees.test.ts && cd ../kernel && bun test tamper.test.ts refusals.test.ts steplaw.test.ts sets.test.ts && cd ../examples && bun test examples.test.ts && cd .. && bun examples/readme.ts && bun examples/composition.ts && bun examples/sets.ts && bun examples/quantifiers.ts && bun examples/functions.ts && bun examples/datatypes.ts && bun examples/lemmas.ts && bun examples/invoices.ts && bun examples/folds.ts && bun examples/trees.ts && bun examples/lists.ts && bun examples/sizes.ts && bun examples/liveness.ts && bun examples/budget.ts && bun examples/gdp.ts && bun examples/steps.ts && bun examples/jev-fabric/run.ts"
   },
   "devDependencies": {
     "@gdp-ts/core": "0.1.0",