gdp-wired 0.10.1 → 0.12.0

package/dist/core/dsl.js

@@ -15,7 +15,7 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf } from "./machine.js";
+import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf, pairedArgs } from "./machine.js";
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
 import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
@@ -774,8 +774,15 @@ export const decimal = (places) => {
 };
 let boundCounter = 0;
 // A condition at every key: only as a whole flag (`flags: ({...}) => ({covered: everyKey(k => ...)})`), the key read
-// only as a map's key. The kernel closes it (instances where it holds, a witness where it fails).
-export const everyKey = (f) => { const key = `k$${++boundCounter}`; return new Cond({ op: 'all', key, c: f(v(key)).c }, everyOk(scope?.keys, k => f(keyTerm(k)).ok)); };
+// only as a map's key. The kernel closes it (instances where it holds, a witness where it fails). With two parameters
+// or more, at every two keys or more (`everyKey((i, j) => i.lt(j).implies(At.at(i).atMost(At.at(j))))`): each key read
+// on its own, and compared with another only plainly (i < j, i <= j, i = j); the runtimes decide it on every tuple of
+// a few keys per breakpoint, so it costs the square of the cells (the cube, over three keys).
+export const everyKey = (f) => {
+    const names = Array.from({ length: Math.max(1, f.length) }, () => `k$${++boundCounter}`), g = f;
+    const ok = (picked) => (picked.length === names.length ? g(...picked).ok : everyOk(scope?.keys, k => ok([...picked, keyTerm(k)])));
+    return new Cond({ op: 'all', key: names[0], ...(names.length > 1 ? { keys: names.slice(1) } : {}), c: g(...names.map(v)).c }, ok([]));
+};
 // Some key where f holds, in a law or a step law's conclusion (¬∀k. ¬f(k)): proven through a witness, a term naming the
 // key, given here or found by the prover among a few candidates (kernel/prove.ts).
 export const someKey = (f, witness) => {
@@ -867,6 +874,7 @@ export class CellsRef {
         return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).each(k => partsOf(this.kind, this.name, f(k))[part])])) };
     }
 }
+const fromOf = (d, p) => (typeof d.from === 'number' ? d.from : d.from(p));
 export class CarriedList {
     name;
     kind;
@@ -874,14 +882,20 @@ export class CarriedList {
     folds;
     map;
     lemmas;
+    params;
+    paramKinds;
     fold;
-    constructor(name, kind, len, folds, map, lemmas = {}) {
+    // `params`: the params' values the folds read (by their kinds: terms for the kernel, constants to encode a request),
+    // undefined where none are given; `paramKinds`, the params themselves, for the lemmas' induction.
+    constructor(name, kind, len, folds, map, lemmas = {}, params, paramKinds = []) {
         this.name = name;
         this.kind = kind;
         this.len = len;
         this.folds = folds;
         this.map = map;
         this.lemmas = lemmas;
+        this.params = params;
+        this.paramKinds = paramKinds;
         this.fold = Object.fromEntries(Object.keys(folds).map(f => [f, map(`${name}$${f}`).at(len)]));
     }
     at(i) { return this.kind.build(this.name, part => this.map(part).at(i)); }
@@ -897,12 +911,21 @@ export class CarriedList {
     equations() {
         const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
         const at = (k) => {
-            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x)));
+            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x, this.p())));
             const below = [...this.kind.invariant(x), ...steps];
-            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k))))] : []));
+            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k, this.p()))))] : []));
         };
         const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
-        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(d.from)), ...(any ? [everyKey(at)] : [])];
+        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(fromOf(d, this.p()))), ...(any ? [everyKey(at)] : [])];
+    }
+    // Whether a fold reads the params (its start a function, or its step taking them).
+    get readsParams() { return Object.values(this.folds).some(d => typeof d.from === 'function' || d.step.length > 2); }
+    p() {
+        if (this.params)
+            return this.params;
+        if (this.readsParams)
+            throw new RangeError(`${this.name}'s folds read the params: give them (encodeInput(values, params))`);
+        return {};
     }
     running(k) { return Object.fromEntries(Object.keys(this.folds).map(f => [f, this.after(f, k)])); }
     // The lemmas, proven: the folds as a machine counting i up from 0 over items that are functions of i known only by
@@ -916,10 +939,11 @@ export class CarriedList {
         const kindFact = this.kind.invariant(this.kind.value(this.name)).length ? { 'every item is a value of its kind': forall(k => all(...this.kind.invariant(item(k)))) } : {};
         const fns = Object.fromEntries(parts.map((p, j) => [fname(p), fn(1, 'x => 0', j === 0 ? { facts: () => kindFact } : {})]));
         const folds = Object.entries(this.folds);
-        const r = rule(`${this.name}'s folds, by induction`).fns(fns).inputs({}).state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.from])) })
-            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i))])) }));
+        const r = rule(`${this.name}'s folds, by induction`).params(Object.fromEntries(this.paramKinds)).fns(fns).inputs({})
+            .state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, typeof d.from === 'number' ? d.from : (p) => d.from(p)])) })
+            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i), env)])) }));
         const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
-        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i))));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i, env))));
     }
     // Every carried map it is kept in: the items' parts, then each fold's.
     get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
@@ -933,13 +957,13 @@ export class CarriedList {
             if (x !== 0)
                 maps[part].set(i, x); });
         for (const [f, d] of Object.entries(this.folds)) {
-            const acc = maps[`${this.name}$${f}`];
-            let value = d.from;
+            const acc = maps[`${this.name}$${f}`], p = this.p();
+            let value = valOf(fromOf(d, p));
             if (value !== 0)
                 acc.set(0, value);
             items.forEach((enc, i) => {
                 const item = this.kind.build(this.name, part => new Term({ op: 'const', value: enc[part] }, enc[part]));
-                const next = valOf(d.step(new Term({ op: 'const', value }, value), item));
+                const next = valOf(d.step(new Term({ op: 'const', value }, value), item, p));
                 if (next === undefined || !Number.isSafeInteger(next) || next < 0)
                     throw new RangeError(`${this.name}'s fold ${f} reads more than its items`);
                 value = next;
@@ -981,6 +1005,66 @@ export class ItemsRef {
     within() { return forall(k => this.len.atMost(k).implies(all(...this.names.map(part => this.list(part).at(k).eq(0))))); }
     increasing(by) { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(by(this.at(i)).lt(by(this.at(j))))); }
 }
+export class NodeTable {
+    name;
+    kind;
+    children;
+    folds;
+    size;
+    map;
+    tables;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    constructor(name, kind, children, folds, size, map, tables = {}) {
+        this.name = name;
+        this.kind = kind;
+        this.children = children;
+        this.folds = folds;
+        this.size = size;
+        this.map = map;
+        this.tables = tables;
+    }
+    // The node at n (0, or past the end: the empty tree).
+    node(n) {
+        const index = termAt(n);
+        return { index, empty: index.eq(0), value: this.kind.build(this.name, part => this.map(part).at(index)),
+            fold: Object.fromEntries(Object.keys(this.folds).map(f => [f, this.map(`${this.name}$${f}`).at(index)])),
+            kids: Object.fromEntries(this.children.map(c => [c, this.map(`${this.name}^${c}`).at(index)])) };
+    }
+    at(n) { return this.node(n).value; }
+    // Whether nodes can be made from these children (each 0 or a node already there).
+    fits(kids) { return all(...this.children.map(c => termAt(kids[c]).atMost(this.size))); }
+    // Node size + 1, from a value and children already there, when `when` holds (and they fit): its value, children and
+    // folds written, the size grown.
+    make(value, kids, when = yes) {
+        const n = this.size.plus(1), go = when.and(this.fits(kids)), parts = partsOf(this.kind, this.name, value);
+        const val = this.kind.build(this.name, part => termAt(parts[part]));
+        const kidRefs = Object.fromEntries(this.children.map(c => [c, this.node(termAt(kids[c]))]));
+        const writes = {};
+        const put = (part, x) => { writes[part] = this.map(part).set(n, when_(go, x, this.map(part).at(n))); };
+        for (const part of this.kind.vars(this.name))
+            put(part, parts[part]);
+        for (const c of this.children)
+            put(`${this.name}^${c}`, kids[c]);
+        for (const [f, d] of Object.entries(this.folds))
+            put(`${this.name}$${f}`, d.node(val, kidRefs, this.tables));
+        return { [this.name]: { parts: writes }, [`${this.name}_size`]: when_(go, n, this.size) };
+    }
+    // The table's own laws: every node's children are earlier nodes and its folds are its children's, and node 0 and every
+    // key past the end hold nothing (each fold's empty).
+    laws() {
+        const inside = (k) => k.atLeast(1).and(k.atMost(this.size));
+        const folds = Object.entries(this.folds);
+        return [
+            ...(this.children.length ? [[`every ${this.name} node's children are earlier nodes`, forall(k => inside(k).implies(all(...this.children.map(c => this.node(k).kids[c].lt(k)))))]] : []),
+            ...(folds.length ? [[`every ${this.name} node's folds are its children's`, forall(k => inside(k).implies(all(...folds.map(([f, d]) => {
+                        const x = this.node(k);
+                        return x.fold[f].eq(d.node(x.value, Object.fromEntries(this.children.map(c => [c, this.node(x.kids[c])])), this.tables));
+                    }))))]] : []),
+            [`nothing in ${this.name} past its end`, forall(k => k.eq(0).or(this.size.lt(k)).implies(all(...this.kind.vars(this.name).map(part => this.map(part).at(k).eq(0)), ...this.children.map(c => this.node(k).kids[c].eq(0)), ...folds.map(([f, d]) => this.node(k).fold[f].eq(d.empty)))))],
+        ];
+    }
+}
+const termAt = (t) => (t instanceof Term ? t : lit(t));
 // A law about every key of a map: proven at a fresh key, assumed at the keys a step reads.
 // With two parameters or more, about every two keys or more: forall((i, j) => i.lt(j).implies(...)).
 export function forall(f) { return { forall: f }; }
@@ -1002,7 +1086,7 @@ function swapC(c, from, to) {
         case 'not': return { op: 'not', x: swapC(c.x, from, to) };
         case 'and':
         case 'or': return { op: c.op, xs: c.xs.map(y => swapC(y, from, to)) };
-        case 'all': return { op: 'all', key: c.key, c: swapC(c.c, from, to) };
+        case 'all': return { ...c, c: swapC(c.c, from, to) };
         case 'flag': return c;
         case '<':
         case '<=':
@@ -1093,15 +1177,15 @@ class Hoister {
     quantifier(q, bound, name) {
         const outer = bound.filter(key => namesIn(q).includes(key));
         if (outer.length)
-            throw new Error(`a condition at every key reads ${outer[0]}, a key bound outside it: two keys at once are outside the kernel`);
-        const inner = perStep(q.c);
+            throw new Error(`a condition at every key reads ${outer[0]}, a key bound outside it: two keys at once are named together (everyKey((i, j) => ...))`);
+        const inner = perStep(q.c), keys = q.keys?.length ? { keys: q.keys } : {};
         if (!inner) {
             const f = name ?? `${this.prefix}${++this.n}`;
-            this.flags[f] = { op: 'all', key: q.key, c: q.c };
+            this.flags[f] = { op: 'all', key: q.key, ...keys, c: q.c };
             return { op: 'flag', name: f };
         }
-        const truth = inner.op === 'flag' ? inner : this.quantifier(inner, [...bound, q.key]);
-        const split = (by) => this.quantifier({ op: 'all', key: q.key, c: swapC(q.c, inner, by) }, bound);
+        const truth = inner.op === 'flag' ? inner : this.quantifier(inner, [...bound, q.key, ...(q.keys ?? [])]);
+        const split = (by) => this.quantifier({ op: 'all', key: q.key, ...keys, c: swapC(q.c, inner, by) }, bound);
         return { op: 'or', xs: [{ op: 'and', xs: [truth, split(yes.c)] }, { op: 'and', xs: [{ op: 'not', x: truth }, split(no.c)] }] };
     }
 }
@@ -1134,6 +1218,8 @@ function prenex(c, what, key) {
     const walk = (d, positive) => {
         switch (d.op) {
             case 'all':
+                if (d.keys?.length)
+                    throw new Error(`${what}: a condition at every two keys in a law is the law's own keys (forall((i, j) => ...))`);
                 if (!positive)
                     return d;
                 found = true;
@@ -1194,6 +1280,8 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         if (!plain.test(n) || reservedInRecur.includes(n) || n === name)
             throw new Error(`recur ${name}: ${n} can't name an argument or a function here (${reservedInRecur.join(', ')} and ${name} are taken)`);
     distinctNames(`recur ${name}`, [...args, ...uses.map(([u]) => u)]);
+    // A rule reads the function at its arguments paired, which the kernel multiplies out: with five further arguments that
+    // is a polynomial of degree 32, past what it can hold.
     if (args.length > 4)
         throw new Error(`recur ${name}: at most four further arguments`);
     const named = (n) => new Term({ op: 'var', name: n });
@@ -1244,8 +1332,9 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
     const keysOf = (n) => (f) => {
         if (n === 0)
             return f();
-        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d),
-            (a, b, c, d, e) => f(a, b, c, d, e), (a, b, c, d, e, g) => f(a, b, c, d, e, g)][n - 1];
+        // A law's keys are counted by its callback's parameters: this one takes n.
+        const by = (...ks) => f(...ks);
+        Object.defineProperty(by, 'length', { value: n });
         return forall(by);
     };
     const facts = (withBetween) => (f, at = {}) => {
@@ -1279,7 +1368,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
 };
 const distinctNames = (what, names) => { if (new Set(names).size !== names.length)
     throw new Error(`${what}: a name given twice`); };
-// A recurrence as JavaScript: a function of its arguments, the functions it reads inlined (each as a function of its key,
+// A recurrence as JavaScript: a function of its arguments, the functions it reads inlined (each called on its arguments,
 // as the runtimes call it).
 const recurJs = (name, args, zero, next, uses) => {
     const fns = new Map(uses.map(([u], i) => [u, `$f${i}`]));
@@ -1294,7 +1383,10 @@ const recurJs = (name, args, zero, next, uses) => {
             case 'min': return `Math.min(${js(e.a)}, ${js(e.b)})`;
             case 'max': return `Math.max(${js(e.a)}, ${js(e.b)})`;
             case 'if': return `(${jc(e.c)} ? ${js(e.then)} : ${js(e.else)})`;
-            case 'get': return `${fns.get(e.map)}(${js(e.key)})`;
+            case 'get': {
+                const i = uses.findIndex(([u]) => u === e.map), args = uses[i][1].arity > 1 ? pairedArgs(e.key, uses[i][1].arity) : undefined;
+                return args ? `$g${i}(${args.map(js).join(', ')})` : `${fns.get(e.map)}(${js(e.key)})`;
+            }
         }
     };
     const jc = (c) => {
@@ -1309,7 +1401,7 @@ const recurJs = (name, args, zero, next, uses) => {
             case 'all': throw new Error('a recurrence takes no flag or quantifier');
         }
     };
-    const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); `).join('');
+    const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); ${d.arity > 1 ? `const $g${i} = (${jsOf(d)}); ` : ''}`).join('');
     // The last value computed at each tuple of further arguments is kept, so reading f at x after f at a smaller x takes
     // only the steps between (a rule that reads f at a count that grows costs one step a request).
     return `(() => { ${inlined}const $memo = new Map(); return (x, ${args.map(a => `${a}, `).join('')}) => { const $k = ${args.length ? `[${args.join(', ')}].join()` : "''"}; let $at = $memo.get($k); if (!$at || $at[0] > x) $at = [0, ${js(zero)}]; let x0 = $at[0], prev = $at[1]; for (; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } if ($memo.size > 4096) $memo.clear(); $memo.set($k, [x, prev]); return prev; }; })()`;
@@ -1322,8 +1414,9 @@ const flatFns = (defs) => defs.flatMap(([n, d]) => {
 const pairE = (a, b) => { const s = { op: 'add', a, b }; return { op: 'add', a: { op: 'prod', a: s, b: s }, b }; };
 const argsKey = (args) => args.slice(1).reduce(pairE, args[0]);
 // A function's JavaScript as one function of its key: its arguments unpaired (left-nested, as argsKey pairs them).
+const jsOf = (d) => (typeof d.js === 'string' ? d.js : String(d.js));
 const fnSource = (name, d) => {
-    const src = typeof d.js === 'string' ? d.js : String(d.js);
+    const src = jsOf(d);
     let f;
     try {
         f = compileFunction([], `return (${src})`)();
@@ -1372,7 +1465,7 @@ const markedE = (e) => {
         case 'prod': return { ...e, a: markedE(e.a), b: markedE(e.b) };
     }
 };
-const marked = (c) => c.op === 'flag' ? c : c.op === 'all' ? { op: 'all', key: c.key, c: marked(c.c) } : c.op === 'not' ? { op: 'not', x: marked(c.x) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(marked) } : { ...c, a: markedE(c.a), b: markedE(c.b) };
+const marked = (c) => c.op === 'flag' ? c : c.op === 'all' ? { ...c, c: marked(c.c) } : c.op === 'not' ? { op: 'not', x: marked(c.x) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(marked) } : { ...c, a: markedE(c.a), b: markedE(c.b) };
 // P params, I inputs, S state, M maps, F flags, R a history's record, Su its sums, Q its queries: each a record of the
 // values the builders hand out, grown by each call.
 export class Rule {
@@ -1446,6 +1539,19 @@ export class Rule {
         return this.with({ maps: [...this.spec.maps, ...entries.flatMap(([n, k]) => k.vars(n).map(part => [part, 0]))],
             state: [...this.spec.state, ...entries.map(([n]) => [`${n}_len`, 0])], items: [...(this.spec.items ?? []), ...entries] });
     }
+    // A table of nodes, empty at the start (NodeTable): a tree in the state, made one node a step.
+    nodes(name, of, children, folds = {}) {
+        for (const c of children)
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(c) || c === 'value')
+                throw new Error(`${name}: ${c} can't name a child`);
+        for (const f of Object.keys(folds))
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                throw new Error(`${name}: ${f} is not a plain fold name`);
+        distinctNames(name, [...children]);
+        const maps = [...of.vars(name).map(part => [part, 0]), ...children.map(c => [`${name}^${c}`, 0]),
+            ...Object.entries(folds).map(([f, d]) => [`${name}$${f}`, d.empty])];
+        return this.with({ maps: [...this.spec.maps, ...maps], state: [...this.spec.state, [`${name}_size`, 0]], nodes: [...(this.spec.nodes ?? []), [name, of, [...children], folds]] });
+    }
     // Functions defined outside the rule (fn, divBy, modBy), read like params that take arguments: f(x).
     fns(defs) {
         return this.with({ fns: [...(this.spec.fns ?? []), ...Object.entries(defs)] });
@@ -1456,6 +1562,7 @@ export class Rule {
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
     // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
     //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
+    // Each fold's start and step, and each lemma, may read the params declared before it.
     carriesList(name, of, folds = {}, lemmas = {}) {
         const entries = [[name, of, folds, lemmas]];
         for (const [n, , fs] of entries)
@@ -1464,7 +1571,7 @@ export class Rule {
                     throw new Error(`${n}: ${f} is not a plain fold name`);
         // The folds' lemmas, proven now (a lemma that isn't throws, with the verdict).
         for (const [n, k, fs, ls] of entries) {
-            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls).prove();
+            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, undefined, this.spec.params).prove();
             if (!(v2.proven && v2.checked))
                 throw new Unproven(`${n}'s fold lemmas`, v2);
         }
@@ -1530,6 +1637,12 @@ export class Rule {
             if (k.invariant(k.value(n)).length) {
                 out.push(this.law(`every ${n} cell is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
             }
+        for (const [n, k] of this.spec.nodes ?? []) {
+            if (k.invariant(k.value(n)).length)
+                out.push(this.law(`every ${n} node is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
+            for (const [name] of this.env({ flags: false, inputs: false, queries: false })[n].laws())
+                out.push(this.law(name, env => of(env, n).laws().find(([m]) => m === name)[1]));
+        }
         return out;
     }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
@@ -1547,7 +1660,7 @@ export class Rule {
         const [k1, more] = keysFor(out), c = out.forall(v(k1), ...more.map(v)).c;
         return withSource(more.length ? { name, forall: k1, keys: more, then: c, ...w } : { name, forall: k1, then: prenex(c, `step law ${name}`, k1) ?? c, ...w }, src);
     }
-    // A law about k steps in a row (k from 2 to 16): `then(first, last, requests)` relates what the first step reads to the
+    // A law about k steps in a row (k from 2 to 64): `then(first, last, requests)` relates what the first step reads to the
     // state, maps and sums after the last, with each step's request and queries (requests[0] is the first's); `when(before,
     // j)` narrows the j-th step's request (j from 0), read at the state that step starts from.
     //   meter.stepsLaw('two requests spend at most 2m', 2, ({spent, m}, after) => after.spent.atMost(spent.plus(m).plus(m)))
@@ -1649,8 +1762,9 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            const ps = Object.fromEntries(this.spec.params.map(([n]) => [n, out[n]]));
             for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
-                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls);
+                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls, ps, this.spec.params);
                 for (const part of l.maps)
                     delete out[part];
                 out[n] = l;
@@ -1697,6 +1811,15 @@ export class Rule {
                 delete out[part];
             out[n] = new ItemsRef(n, k, len(n), part => new ListRef(at(part), len(n)));
         }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const tables = {};
+        for (const [n, k, cs, fs] of this.spec.nodes ?? []) {
+            const t = new NodeTable(n, k, cs, fs, v(at(`${n}_size`)), part => new MapRef(at(part), init.get(part)), { ...tables });
+            tables[n] = t;
+            for (const part of [...k.vars(n), ...cs.map(c => `${n}^${c}`), ...Object.keys(fs).map(f => `${n}$${f}`)])
+                delete out[part];
+            out[n] = t;
+        }
     }
     // Every name the rule declares is declared once (a flag named again replaces the earlier one, so flags are checked as
     // they are defined): an input and a state variable sharing a name would hand the callbacks only one of them.
@@ -1705,6 +1828,7 @@ export class Rule {
         return [...s.params.map(([n]) => [n, 'a param']), ...(s.fns ?? []).map(([n]) => [n, 'a function']), ...s.inputs.map(([n]) => [n, 'an input']), ...(s.carried ?? []).map(n => [n, 'a carried map']),
             ...s.state.map(([n]) => [n, 'a state variable']), ...s.maps.map(([n]) => [n, 'a map']), ...s.sums.map(([n]) => [n, 'a sum']), ...s.queries.map(([n]) => [n, 'a query']),
             ...[...(s.cells ?? []), ...(s.items ?? [])].filter(([n, k]) => !k.vars(n).includes(n)).map(([n]) => [n, 'a map of a kind']),
+            ...(s.nodes ?? []).map(([n]) => [n, 'a table of nodes']),
         ];
     }
     whatIs(n) { return this.names().find(([m]) => m === n)?.[1] ?? 'something else'; }
@@ -1770,7 +1894,7 @@ export class Rule {
         // Functions, and their facts: each function's own (named after it), then the rule's.
         // The functions a function reads come first, each named <function>.<use>.
         const flat = flatFns(s.fns ?? []);
-        const fns = Object.fromEntries(flat.map(([n, d]) => [n, { js: fnSource(n, d), ...(d.lean ? { lean: d.lean } : {}), ...(d.recur ? { recur: d.recur } : {}) }]));
+        const fns = Object.fromEntries(flat.map(([n, d]) => [n, { js: fnSource(n, d), ...(d.arity > 1 ? { arity: d.arity, call: jsOf(d) } : {}), ...(d.lean ? { lean: d.lean } : {}), ...(d.recur ? { recur: d.recur } : {}) }]));
         const facts = [
             ...flat.flatMap(([n, d, uses]) => Object.entries(d.facts?.(fnTerm(n, d), uses) ?? {}).map(([name, f]) => this.lawOf(`${n}: ${name}`, f))),
             ...(s.facts ?? []).flatMap(f => Object.entries(f(pEnv)).map(([name, out]) => this.lawOf(name, out))),
@@ -1837,7 +1961,7 @@ export class Rule {
                 }
                 if (d === (opts.depth ?? 8))
                     break;
-                const input = this.randomInput(rand, bound);
+                const input = this.randomInput(rand, bound, params);
                 if (s.prune || !allowed(m, run, params, st, input))
                     continue;
                 d++;
@@ -1961,7 +2085,7 @@ export class Rule {
             const edges = trial === 0 ? opts.edges ?? [] : [];
             for (let d = 0; d < (opts.depth ?? 10) + edges.length; d++) {
                 const request = edges[d] ?? opts.draw?.(rand) ?? sample(s.inputs);
-                ours = gen.step(ps, ours, this.encodeInput(request));
+                ours = gen.step(ps, ours, this.encodeInput(request, params));
                 theirs = reference.step(params, theirs, request);
                 const got = this.decode(ours);
                 for (const [field, want] of Object.entries(theirs)) {
@@ -1977,10 +2101,12 @@ export class Rule {
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
     // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
-    // A carried list is an array of its items' runtime values (its length and folds computed from them).
+    // A carried list is an array of its items' runtime values (its length and folds computed from them); `params`, what
+    // folds that read the params are computed with.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    encodeInput(values) {
-        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(values[n])]));
+    encodeInput(values, params) {
+        const at = params && this.paramValues(this.encodeParams(params));
+        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, at).encode(values[n])]));
         const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
         for (const l of Object.values(lists))
             Object.assign(out, l.maps);
@@ -1994,13 +2120,18 @@ export class Rule {
     }
     // Random params and inputs that meet their kinds (not the user's `pre` or `assume`, which a caller checks).
     randomParams(rand, bound) { return Object.assign({}, ...this.spec.params.map(([n, k]) => k.random(n, rand, bound))); }
-    randomInput(rand, bound) {
+    // The params' values by their kinds, as constants (what a fold that reads them is computed with).
+    paramValues(ps) {
+        return Object.fromEntries(this.spec.params.map(([n, k]) => [n, k.build(n, part => new Term({ op: 'const', value: ps[part] }, ps[part]))]));
+    }
+    // `ps`: the params (encoded), for folds that read them.
+    randomInput(rand, bound, ps) {
         const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
         for (const n of this.spec.carried ?? [])
             out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
         // A carried list: items drawn by their kind, its length and folds as the encoding computes them.
         for (const [n, k, fs] of this.spec.lists2 ?? []) {
-            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
+            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), {}, ps && this.paramValues(ps)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
             Object.assign(out, l.maps, { [`${n}_len`]: l.len });
         }
         return out;
@@ -2022,6 +2153,11 @@ export class Rule {
         }
         for (const [n, k] of this.spec.items ?? [])
             out[n] = Array.from({ length: st.scalars[`${n}_len`] }, (_, i) => cell(n, k, i));
+        // A table of nodes: node 1 first, each its value and its children.
+        for (const [n, k, cs] of this.spec.nodes ?? []) {
+            const at = (part, key) => st.maps[part]?.get(key) ?? 0;
+            out[n] = Array.from({ length: st.scalars[`${n}_size`] }, (_, i) => ({ value: cell(n, k, i + 1), ...Object.fromEntries(cs.map(c => [c, at(`${n}^${c}`, i + 1)])) }));
+        }
         return out;
     }
     // The prune order's variable, if the history is pruned (a runtime must send it nondecreasing).
@@ -2105,7 +2241,7 @@ export class Fun {
         this.compiledRule ??= (rule => ({ rule, gen: rule.compiled() }))(this.rule);
         const { rule, gen } = this.compiledRule, ps = rule.encodeParams(params);
         const kinds = Object.entries(this.result(this.r['env']({ flags: false, state: false, queries: false })));
-        const st = rule.decode(gen.step(ps, gen.init(ps), rule.encodeInput(values)));
+        const st = rule.decode(gen.step(ps, gen.init(ps), rule.encodeInput(values, params)));
         return Object.fromEntries(kinds.map(([k]) => [k, st[`out.${k}`]]));
     }
 }
@@ -2212,7 +2348,7 @@ export function crossCheckDecision(d, opts = {}) {
     const r = d.rule, m = r.machine, bound = opts.bound ?? 4, rand = opts.rand ?? seeded(11), own = d.given.slice(d.given.length - src.own);
     let checked = 0;
     for (let i = 0; i < (opts.trials ?? 500); i++) {
-        const input = r.randomInput(rand, bound), values = { ...r.randomParams(rand, bound), ...numbersOf(input) };
+        const ps = r.randomParams(rand, bound), input = r.randomInput(rand, bound, ps), values = { ...ps, ...numbersOf(input) };
         const st = { scalars: {}, maps: Object.fromEntries(Object.entries(input).filter((e) => typeof e[1] !== 'number').map(([n, cells]) => [n, new Map(cells)])) };
         const keys = exactKeys(keysOf(bound, st), values, st);
         const sc = { vars: values, maps: Object.fromEntries(Object.entries(st.maps).map(([n, cells]) => [n, { cells, dflt: 0 }])), keys, flags: {} };
@@ -2243,6 +2379,11 @@ export class FoldRule {
     assume(f) { return this.with({ assume: [...this.spec.assume, f] }); }
     leaf(f) { return this.with({ leaf: f }); }
     node(f) { return this.with({ node: f }); }
+    // Nodes with any number of children (RoseFold): the children's values folded into `kids`, from `from` by `step` (which
+    // reads the params), each lemma a law of every prefix of every node's children that meet the fold's laws.
+    children(from, step, lemmas = {}) {
+        return new RoseFold(this.spec, { from: from, step: step, lemmas: lemmas });
+    }
     env(inputs = true) {
         const out = {};
         for (const [n, k] of this.spec.params)
@@ -2337,4 +2478,151 @@ export class FoldRule {
     }
 }
 export const fold = (name) => new FoldRule({ name, params: [], inputs: [], pre: [], assume: [] });
-export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, laws));
+// A fold's laws proven over every tree (a rose fold's own laws, its children's lemmas, with them).
+export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, [...(f.lemmas ?? []), ...laws]));
+const asTerm = (t) => (t instanceof Term ? t : lit(t));
+// A fold over trees whose nodes have any number of children, as the kernel's binary fold (so the kernel and Lean's
+// fold_sound check it as they check any fold): a node's children become a chain of glue nodes, each folding one child
+// into the values of the rest (`kids`, from `from` at the chain's end), and the node reads the chain's values. Every
+// tree node carries `kind$` (0 a node or leaf of the tree, 1 a glue node or the chain's end) and its role as an input; a
+// law of the fold is claimed where kind$ is 0, each lemma where it is 1. A binary tree no rose tree maps to (a child
+// where a chain belongs, or a chain where a child does) is read as one that does: a node reads a chain only, a glue
+// node a child only, so the laws are proven of every binary tree, and of each rose tree's image in particular.
+//   fold('org chart').params({cap: nat}).inputs({pay: nat})
+//     .leaf(({pay}) => ({cost: pay, heads: 1}))
+//     .children({cost: 0, heads: 0}, (acc, kid) => ({cost: acc.cost.plus(kid.cost), heads: acc.heads.plus(kid.heads)}))
+//     .node(({pay}, kids) => ({cost: kids.cost.plus(pay), heads: kids.heads.plus(1)}))
+export class RoseFold {
+    spec;
+    kids;
+    nodeOf;
+    constructor(spec, kids, nodeOf) {
+        this.spec = spec;
+        this.kids = kids;
+        this.nodeOf = nodeOf;
+    }
+    get name() { return this.spec.name; }
+    node(f) { return new RoseFold(this.spec, this.kids, f); }
+    env(inputs = true) {
+        const out = {};
+        for (const [n, k] of this.spec.params)
+            out[n] = k.value(n);
+        if (inputs)
+            for (const [n, k] of this.spec.inputs)
+                out[n] = k.value(n);
+        return out;
+    }
+    names() {
+        if (!this.spec.leaf)
+            throw new Error(`${this.spec.name}: a fold needs a leaf`);
+        return Object.keys(this.spec.leaf(this.env()));
+    }
+    side(prefix) { return Object.fromEntries(this.names().map(n => [n, v(`${prefix}${n}`)])); }
+    accs(prefix) { return Object.fromEntries(Object.keys(this.kids.from).map(a => [a, v(`${prefix}kids$${a}`)])); }
+    start(p) { return Object.fromEntries(Object.entries(this.kids.from).map(([a, x]) => [a, typeof x === 'number' ? lit(x) : asTerm(x(p))])); }
+    // A law about the values and the params, claimed of every node and leaf of the tree.
+    law(name, f) { return { name, holds: v('kind$').atLeast(1).or(f({ ...this.env(false), ...this.side('') })).c }; }
+    // The children's lemmas (claimed of every glue node), and that kind$ is 0 or 1: proveFold adds them.
+    get lemmas() {
+        const p = this.env(false);
+        return [{ name: `${this.spec.name}: kind$ is 0 or 1`, holds: v('kind$').atMost(1).c },
+            ...Object.entries(this.kids.lemmas).map(([n, l]) => ({ name: n, holds: v('kind$').eq(0).or(l(this.accs(''), p)).c }))];
+    }
+    get fold() {
+        const s = this.spec, node = this.nodeOf;
+        if (!s.leaf || !node)
+            throw new Error(`${s.name}: a fold needs a leaf and a node`);
+        const env = this.env(), pEnv = this.env(false), names = this.names(), accNames = Object.keys(this.kids.from);
+        const role = v('role$'), real = role.eq(0);
+        const pre = [...s.params.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.pre.map(f => f(pEnv).c)];
+        const own = all(...s.inputs.flatMap(([n, k]) => k.assume(n)), ...s.assume.map(f => f(env)));
+        const assume = role.atMost(1).and(role.eq(1).or(own)).c;
+        const start = this.start(pEnv);
+        // A leaf of the tree, or the end of a chain (no children yet).
+        const leafOut = s.leaf(env);
+        const leaf = { ...Object.fromEntries(names.map(n => [n, when(real, leafOut[n], 0).e])),
+            ...Object.fromEntries(accNames.map(a => [`kids$${a}`, when(real, 0, start[a]).e])), 'kind$': when(real, 0, 1).e };
+        // A node reads the chain on its left (its children's values); a glue node folds its left child into the rest.
+        const lAcc = this.accs('l_'), rAcc = this.accs('r_'), lk = v('l_kind$'), rk = v('r_kind$');
+        const kidsIn = Object.fromEntries(accNames.map(a => [a, when(lk.eq(1), lAcc[a], start[a])]));
+        const rest = Object.fromEntries(accNames.map(a => [a, when(rk.eq(1), rAcc[a], start[a])]));
+        const nodeOut = node(env, kidsIn), stepped = this.kids.step(rest, this.side('l_'), pEnv);
+        const nodeE = { ...Object.fromEntries(names.map(n => [n, when(real, nodeOut[n], 0).e])),
+            ...Object.fromEntries(accNames.map(a => [`kids$${a}`, when(real, 0, when(lk.eq(0), stepped[a], rest[a])).e])), 'kind$': when(real, 0, 1).e };
+        return { name: s.name, params: s.params.flatMap(([n, k]) => k.vars(n)), inputs: [...s.inputs.flatMap(([n, k]) => k.vars(n)), 'role$'], leaf, node: nodeE,
+            ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}), assume };
+    }
+    // The values of a rose tree, by the terms proven (the tree as the binary tree the fold reads it as).
+    run(tree, params = {}) {
+        const f = this.fold, ps = encode(this.spec.params, params), none = { name: f.name, params: [], inputs: [], state: {}, step: {} };
+        const st = { scalars: {}, maps: {} };
+        if (f.pre && !evalC(f.pre, ps, st, none))
+            throw new RangeError(`${f.name}: the params don't meet its precondition`);
+        const zero = Object.fromEntries(f.inputs.map(n => [n, 0]));
+        const at = (exprs, env) => Object.fromEntries(Object.entries(exprs).map(([n, e]) => [n, evalE(e, env, st, none)]));
+        const kidsOf = (vals, prefix) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [`${prefix}${n}`, x]));
+        const chain = (cs) => {
+            const env = { ...ps, ...zero, 'role$': 1 };
+            if (!cs.length)
+                return at(f.leaf, env);
+            return at(f.node, { ...env, ...kidsOf(go(cs[0]), 'l_'), ...kidsOf(chain(cs.slice(1)), 'r_') });
+        };
+        const go = (t) => {
+            const own = 'leaf' in t ? t.leaf : t.node, env = { ...ps, ...encode(this.spec.inputs, own), 'role$': 0 };
+            if (f.assume && !evalC(f.assume, env, st, none))
+                throw new RangeError(`${f.name}: ${JSON.stringify(own)} doesn't meet its assumption`);
+            if ('leaf' in t)
+                return at(f.leaf, env);
+            return at(f.node, { ...env, ...kidsOf(chain(t.children), 'l_'), ...kidsOf(chain([]), 'r_') });
+        };
+        const out = go(tree);
+        return Object.fromEntries(this.names().map(n => [n, out[n]]));
+    }
+    // The builders against what they built, on random rose trees: each value by the callbacks' own arithmetic (the
+    // children folded by step, then the node) against the terms proven, and each law and lemma at the root.
+    crossCheck(laws = [], opts = {}) {
+        const s = this.spec, rand = opts.rand ?? seeded(17), bound = opts.bound ?? 6, f = this.fold;
+        let checked = 0;
+        const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
+        const tree = (d) => (d === 0 || rand(3) === 0 ? { leaf: sample(s.inputs) } : { node: sample(s.inputs), children: Array.from({ length: rand(4) }, () => tree(d - 1)) });
+        const known = (vals) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [n, new Term({ op: 'const', value: x }, x)]));
+        const nums = (out) => { const vals = Object.entries(out).map(([n, x]) => [n, valOf(x)]); return vals.every(([, x]) => x !== undefined) ? Object.fromEntries(vals) : undefined; };
+        for (let t = 0; t < (opts.trials ?? 200); t++) {
+            const params = sample(s.params), ps = encode(s.params, params);
+            const pv = known(ps), pEnv = Object.fromEntries(s.params.map(([n, k]) => [n, k.build(n, part => pv[part])]));
+            const builder = (tr) => {
+                const own = 'leaf' in tr ? tr.leaf : tr.node, iv = known(encode(s.inputs, own)), env = { ...pEnv, ...Object.fromEntries(s.inputs.map(([n, k]) => [n, k.build(n, part => iv[part])])) };
+                if ('leaf' in tr)
+                    return nums(s.leaf(env));
+                let acc = nums(this.start(pEnv));
+                for (const c of [...tr.children].reverse()) {
+                    const kid = builder(c);
+                    acc = acc && kid && nums(this.kids.step(known(acc), known(kid), pEnv));
+                }
+                return acc && nums(this.nodeOf(env, known(acc)));
+            };
+            const tr = tree(opts.depth ?? 3);
+            let ours;
+            try {
+                ours = this.run(tr, params);
+            }
+            catch {
+                continue;
+            }
+            const theirs = builder(tr);
+            if (!theirs)
+                continue;
+            for (const [n, x] of Object.entries(theirs)) {
+                checked++;
+                if (ours[n] !== x)
+                    return { checked, failure: `${f.name}: ${n} is ${x} by its callbacks, ${ours[n]} by the terms proven, for ${JSON.stringify(tr)}` };
+            }
+            for (const law of laws) {
+                checked++;
+                if (!evalC(law.holds, { ...ps, ...ours, 'kind$': 0 }, { scalars: {}, maps: {} }, { name: f.name, params: [], inputs: [], state: {}, step: {} }))
+                    return { checked, failure: `${f.name}: law ${law.name} fails for ${JSON.stringify(tr)} with params ${JSON.stringify(params)}` };
+            }
+        }
+        return { checked };
+    }
+}