gdp-wired 0.2.0 → 0.4.0

package/dist/core/dsl.js

@@ -15,54 +15,83 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { interpret, loadJs } from "./machine.js";
+import { carriedView, compileFunction, evalC, interpret, loadJs, numbersOf } from "./machine.js";
+import { allowed, keysOf, requestEnv, watch } from "./watch.js";
 import { check, loopObligations } from "../kernel/kernel.js";
-import { grow, proveLaws, proveStepLaws } from "../kernel/prove.js";
+import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
     if (!Number.isSafeInteger(v) || v < 0)
         throw new RangeError(`${v} is not a natural`);
     return v;
 };
-export const termOf = (t) => (typeof t === 'number' ? { op: 'const', value: naturalConst(t) } : t.e);
+export const termOf = (t) => {
+    if (typeof t === 'number')
+        return { op: 'const', value: naturalConst(t) };
+    if (!(t instanceof Term))
+        throw new TypeError('a natural is expected here; an integer or a decimal compares from its own side (x.atMost(n))');
+    return t.e;
+};
 // A natural-valued term. `minus` is truncated (a ∸ b), `times` multiplies by a constant, `mul` by another term (a
 // product: the kernel proves with it, the GPU searches don't take it).
+//
+// Each term and condition may also carry its value (`val`, `ok`), computed beside its expression by plain JavaScript
+// when every value it reads is known: what `crossCheck` compares with the expression the interpreter evaluates, so a
+// builder that writes a different expression than it means is caught on concrete runs.
 export class Term {
     e;
-    constructor(e) {
+    val;
+    constructor(e, val) {
         this.e = e;
+        this.val = val;
     }
-    plus(b) { return new Term({ op: 'add', a: this.e, b: termOf(b) }); }
-    minus(b) { return new Term({ op: 'sub', a: this.e, b: termOf(b) }); }
-    times(k) { return new Term({ op: 'mul', k: naturalConst(k), a: this.e }); }
-    mul(b) { return new Term({ op: 'prod', a: this.e, b: termOf(b) }); }
-    lt(b) { return new Cond({ op: '<', a: this.e, b: termOf(b) }); }
-    atMost(b) { return new Cond({ op: '<=', a: this.e, b: termOf(b) }); }
-    gt(b) { return new Cond({ op: '<', a: termOf(b), b: this.e }); }
-    atLeast(b) { return new Cond({ op: '<=', a: termOf(b), b: this.e }); }
-    eq(b) { return new Cond({ op: '=', a: this.e, b: termOf(b) }); }
+    plus(b) { return new Term({ op: 'add', a: this.e, b: termOf(b) }, both(this.val, valOf(b), (x, y) => x + y)); }
+    minus(b) { return new Term({ op: 'sub', a: this.e, b: termOf(b) }, both(this.val, valOf(b), (x, y) => Math.max(0, x - y))); }
+    times(k) { return new Term({ op: 'mul', k: naturalConst(k), a: this.e }, both(this.val, k, (x, y) => x * y)); }
+    mul(b) { return new Term({ op: 'prod', a: this.e, b: termOf(b) }, both(this.val, valOf(b), (x, y) => x * y)); }
+    lt(b) { return new Cond({ op: '<', a: this.e, b: termOf(b) }, both(this.val, valOf(b), (x, y) => x < y)); }
+    atMost(b) { return new Cond({ op: '<=', a: this.e, b: termOf(b) }, both(this.val, valOf(b), (x, y) => x <= y)); }
+    gt(b) { return new Cond({ op: '<', a: termOf(b), b: this.e }, both(this.val, valOf(b), (x, y) => x > y)); }
+    atLeast(b) { return new Cond({ op: '<=', a: termOf(b), b: this.e }, both(this.val, valOf(b), (x, y) => x >= y)); }
+    eq(b) { return new Cond({ op: '=', a: this.e, b: termOf(b) }, both(this.val, valOf(b), (x, y) => x === y)); }
     ne(b) { return this.eq(b).not(); }
 }
+const valOf = (t) => (typeof t === 'number' ? t : t instanceof Term ? t.val : undefined);
+const both = (a, b, f) => (a === undefined || b === undefined ? undefined : f(a, b));
+// Every value known, or undefined.
+const known = (xs) => (xs.every(x => x !== undefined) ? xs : undefined);
 export class Cond {
     c;
-    constructor(c) {
+    ok;
+    constructor(c, ok) {
         this.c = c;
+        this.ok = ok;
     }
     and(...xs) { return all(this, ...xs); }
     or(...xs) { return any(this, ...xs); }
-    not() { return new Cond({ op: 'not', x: this.c }); }
+    not() { return new Cond({ op: 'not', x: this.c }, this.ok === undefined ? undefined : !this.ok); }
     implies(b) { return any(this.not(), b); }
     iff(b) { return all(this.implies(b), b.implies(this)); }
 }
-export const lit = (v) => new Term(termOf(v));
-export const yes = new Cond({ op: '<=', a: { op: 'const', value: 0 }, b: { op: 'const', value: 0 } });
-export const no = new Cond({ op: '<', a: { op: 'const', value: 0 }, b: { op: 'const', value: 0 } });
-export const all = (...cs) => (cs.length === 0 ? yes : cs.length === 1 ? cs[0] : new Cond({ op: 'and', xs: cs.map(c => c.c) }));
-export const any = (...cs) => (cs.length === 0 ? no : cs.length === 1 ? cs[0] : new Cond({ op: 'or', xs: cs.map(c => c.c) }));
+export const lit = (v) => new Term(termOf(v), v);
+export const yes = new Cond({ op: '<=', a: { op: 'const', value: 0 }, b: { op: 'const', value: 0 } }, true);
+export const no = new Cond({ op: '<', a: { op: 'const', value: 0 }, b: { op: 'const', value: 0 } }, false);
+export const all = (...cs) => (cs.length === 0 ? yes : cs.length === 1 ? cs[0] : new Cond({ op: 'and', xs: cs.map(c => c.c) }, known(cs.map(c => c.ok))?.every(x => x)));
+export const any = (...cs) => (cs.length === 0 ? no : cs.length === 1 ? cs[0] : new Cond({ op: 'or', xs: cs.map(c => c.c) }, known(cs.map(c => c.ok))?.some(x => x)));
 export const not = (c) => c.not();
-export const min = (a, b) => new Term({ op: 'min', a: termOf(a), b: termOf(b) });
-export const max = (a, b) => new Term({ op: 'max', a: termOf(a), b: termOf(b) });
-export const when = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) });
+export const min = (a, b) => new Term({ op: 'min', a: termOf(a), b: termOf(b) }, both(valOf(a), valOf(b), Math.min));
+export const max = (a, b) => new Term({ op: 'max', a: termOf(a), b: termOf(b) }, both(valOf(a), valOf(b), Math.max));
+export function when(c, then, otherwise) {
+    if (then instanceof Decimal || otherwise instanceof Decimal) {
+        const places = (then instanceof Decimal ? then : otherwise).places, d = new Decimal(Int.of(0), places);
+        return new Decimal(when(c, d.lift(then), d.lift(otherwise)), places);
+    }
+    if (then instanceof Int || otherwise instanceof Int || (typeof then === 'number' && then < 0) || (typeof otherwise === 'number' && otherwise < 0)) {
+        const a = Int.of(then), b = Int.of(otherwise);
+        return new Int(when(c, a.pos, b.pos), when(c, a.neg, b.neg));
+    }
+    return new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) }, c.ok === undefined ? undefined : valOf(c.ok ? then : otherwise));
+}
 // A condition by cases: `then` where c holds, `otherwise` elsewhere.
 export const choose = (c, then, otherwise) => any(all(c, then), all(c.not(), otherwise));
 // 1 where c holds, else 0: what a sum over a history adds per record.
@@ -71,8 +100,127 @@ export const sum = (first, ...rest) => rest.reduce((acc, t) => acc.plus(t), type
 // A kind names the variables a value is encoded in, what is assumed of them, the value the builders hand out, and how
 // a runtime value is encoded and drawn at random (the examples' harness draws inputs this way).
 export class Kind {
+    // A runtime value of the kind (what encode takes), for comparing a rule with the code it describes (compare).
+    sample(_rand, _bound) { throw new Error('this kind draws no runtime values'); }
+}
+const v = (name) => new Term({ op: 'var', name }, scope?.vars[name]);
+let scope;
+const inScope = (s, f) => { const outer = scope; scope = s; try {
+    return f();
+}
+finally {
+    scope = outer;
+} };
+const keyTerm = (k) => new Term({ op: 'const', value: k }, k);
+// Keys enough to decide a condition at every key as the interpreter does: these, the key past every map's cells, and
+// every key up to the values in play (where a key compared with them changes).
+const exactKeys = (keys, values, ...states) => {
+    let past = 0;
+    for (const st of states)
+        for (const cells of Object.values(st.maps))
+            for (const k of cells.keys())
+                past = Math.max(past, k + 1);
+    const top = Math.min(64, Math.max(0, ...Object.values(values).filter(x => x <= 64)) + 2);
+    return [...new Set([...keys, past, ...Array.from({ length: top + 1 }, (_, i) => i)])].sort((a, b) => a - b);
+};
+const everyOk = (ks, f) => {
+    if (!ks)
+        return undefined;
+    let out = true;
+    for (const k of ks) {
+        const o = f(k);
+        if (o === undefined)
+            return undefined;
+        if (!o)
+            out = false;
+    }
+    return out;
+};
+const isZero = (t) => t.e.op === 'const' && t.e.value === 0;
+const add = (a, b) => (isZero(b) ? a : isZero(a) ? b : a.plus(b));
+export class Int {
+    pos;
+    neg;
+    constructor(pos, neg) {
+        this.pos = pos;
+        this.neg = neg;
+    }
+    static of(x) {
+        if (x instanceof Int)
+            return x;
+        if (typeof x !== 'number')
+            return new Int(x, lit(0));
+        if (!Number.isSafeInteger(x))
+            throw new RangeError(`${x} is not an integer`);
+        return x >= 0 ? new Int(lit(x), lit(0)) : new Int(lit(0), lit(-x));
+    }
+    plus(b) { const o = Int.of(b); return new Int(add(this.pos, o.pos), add(this.neg, o.neg)); }
+    minus(b) { const o = Int.of(b); return new Int(add(this.pos, o.neg), add(this.neg, o.pos)); }
+    negate() { return new Int(this.neg, this.pos); }
+    times(k) {
+        if (!Number.isSafeInteger(k))
+            throw new RangeError(`${k} is not an integer`);
+        return k >= 0 ? new Int(this.pos.times(k), this.neg.times(k)) : new Int(this.neg.times(-k), this.pos.times(-k));
+    }
+    lt(b) { const o = Int.of(b); return add(this.pos, o.neg).lt(add(o.pos, this.neg)); }
+    atMost(b) { const o = Int.of(b); return add(this.pos, o.neg).atMost(add(o.pos, this.neg)); }
+    gt(b) { return Int.of(b).lt(this); }
+    atLeast(b) { return Int.of(b).atMost(this); }
+    eq(b) { const o = Int.of(b); return add(this.pos, o.neg).eq(add(o.pos, this.neg)); }
+    ne(b) { return this.eq(b).not(); }
+    min(b) { return when(this.atMost(b), this, b); }
+    max(b) { return when(this.atLeast(b), this, b); }
+    get isNegative() { return this.neg.gt(this.pos); }
+    // |value|, and the value where it is not negative (0 below).
+    get abs() { return this.pos.minus(this.neg).plus(this.neg.minus(this.pos)); }
+    get clamped() { return this.pos.minus(this.neg); }
+}
+// The same value with at most one part nonzero (what a state variable holds).
+const normal = (i) => (isZero(i.neg) || isZero(i.pos) ? i : new Int(i.pos.minus(i.neg), i.neg.minus(i.pos)));
+const termValue = (t) => (t.e.op === 'const' ? t.e.value : 0);
+const scaledOf = (x, places, what = 'a decimal') => {
+    const text = typeof x === 'number' ? x.toFixed(places + 3) : x.trim();
+    const m = /^(-?)(\d+)(?:\.(\d+))?$/.exec(text);
+    if (!m)
+        throw new RangeError(`${String(x)} is not ${what}`);
+    const frac = (m[3] ?? '').replace(/0+$/, '');
+    if (frac.length > places)
+        throw new RangeError(`${String(x)} needs more than ${places} decimal places`);
+    const n = Number(m[2]) * 10 ** places + Number(frac.padEnd(places, '0') || '0');
+    if (!Number.isSafeInteger(n))
+        throw new RangeError(`${String(x)} is too large`);
+    return m[1] && n !== 0 ? -n : n;
+};
+export class Decimal {
+    int;
+    places;
+    constructor(int, places) {
+        this.int = int;
+        this.places = places;
+    }
+    lift(b) {
+        if (b instanceof Decimal) {
+            if (b.places !== this.places)
+                throw new Error(`decimals with ${this.places} and ${b.places} places don't mix`);
+            return b.int;
+        }
+        return typeof b === 'number' ? Int.of(scaledOf(b, this.places)) : Int.of(b).times(10 ** this.places);
+    }
+    with(i) { return new Decimal(i, this.places); }
+    plus(b) { return this.with(this.int.plus(this.lift(b))); }
+    minus(b) { return this.with(this.int.minus(this.lift(b))); }
+    negate() { return this.with(this.int.negate()); }
+    times(k) { return this.with(this.int.times(k)); }
+    lt(b) { return this.int.lt(this.lift(b)); }
+    atMost(b) { return this.int.atMost(this.lift(b)); }
+    gt(b) { return this.int.gt(this.lift(b)); }
+    atLeast(b) { return this.int.atLeast(this.lift(b)); }
+    eq(b) { return this.int.eq(this.lift(b)); }
+    ne(b) { return this.int.ne(this.lift(b)); }
+    min(b) { return this.with(this.int.min(this.lift(b))); }
+    max(b) { return this.with(this.int.max(this.lift(b))); }
+    get isNegative() { return this.int.isNegative; }
 }
-const v = (name) => new Term({ op: 'var', name });
 const asNat = (name, raw) => {
     if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < 0)
         throw new RangeError(`${name} must be a natural, not ${String(raw)}`);
@@ -94,6 +242,7 @@ class NatKind extends Kind {
         return { [name]: n };
     }
     random(name, rand, bound) { return { [name]: rand((this.maxValue ?? bound) + 1) }; }
+    sample(rand, bound) { return this.maxValue !== undefined && rand(8) === 0 ? this.maxValue : rand((this.maxValue ?? bound) + 1); }
 }
 export const nat = new NatKind();
 // A natural known to be at most `maxValue` (a percentage, a floor number, a weekday).
@@ -102,7 +251,7 @@ export const upTo = (maxValue) => new NatKind(naturalConst(maxValue));
 export class Bool extends Cond {
     n;
     constructor(n) {
-        super({ op: '=', a: n.e, b: { op: 'const', value: 1 } });
+        super({ op: '=', a: n.e, b: { op: 'const', value: 1 } }, n.val === undefined ? undefined : n.val === 1);
         this.n = n;
     }
 }
@@ -118,6 +267,7 @@ class BoolKind extends Kind {
         throw new RangeError(`${name} must be a boolean, not ${String(raw)}`);
     }
     random(name, rand) { return { [name]: rand(2) }; }
+    sample(rand) { return rand(2) === 1; }
 }
 export const bool = new BoolKind();
 // One of a few named values, encoded as its index. `match` takes every case (TypeScript checks none is missing).
@@ -162,6 +312,7 @@ class OneOfKind extends Kind {
         return { [name]: i };
     }
     random(name, rand) { return { [name]: rand(this.values.length) }; }
+    sample(rand) { return this.values[rand(this.values.length)]; }
 }
 export const oneOf = (...values) => new OneOfKind(values);
 // A value that may be missing, encoded as a presence bit and the value. The value can only be read in `some`, so no
@@ -203,26 +354,459 @@ class MaybeKind extends Kind {
     random(name, rand, bound) {
         return rand(4) === 0 ? { [this.has(name)]: 0, ...Object.fromEntries(this.of.vars(name).map(n => [n, rand(bound + 1)])) } : { [this.has(name)]: 1, ...this.of.random(name, rand, bound) };
     }
+    sample(rand, bound) { return rand(4) === 0 ? null : this.of.sample(rand, bound); }
 }
 export const maybe = (of) => new MaybeKind(of);
+// A string, encoded as its interned name, its length and one bit per pattern the kind declares (`like`, Cedar's glob:
+// `*` any run of characters, `\*` a star): all computed from the string itself when the input is encoded, so the bits
+// are the string's, not an answer someone supplies. Names come from one table per process, the empty string 0; a law
+// compares strings by name. Equal strings have equal lengths and pattern bits, and `eq` says so, with a literal or with
+// another string, so a law may reason from either. (Names are this process's: state that keeps them across processes
+// keeps `interned()` with them, and `intern.load` restores it before any rule is built.)
+const internTable = new Map([['', 0]]);
+// The strings rules and laws name as literals (what random draws favor).
+const literals = new Set(['']);
+const literal = (text) => (literals.add(text), intern(text));
+export const intern = Object.assign((text) => {
+    let id = internTable.get(text);
+    if (id === undefined)
+        internTable.set(text, (id = internTable.size));
+    return id;
+}, { load(entries) { for (const [text, id] of entries) {
+        if (internTable.has(text) && internTable.get(text) !== id)
+            throw new Error(`"${text}" is interned as ${internTable.get(text)} already`);
+        internTable.set(text, id);
+    } } });
+export const interned = () => [...internTable];
+export const globMatch = (pattern, text) => {
+    const parts = [[]];
+    for (let i = 0; i < pattern.length; i++) {
+        if (pattern[i] === '\\' && pattern[i + 1] === '*') {
+            parts.at(-1).push('*');
+            i++;
+        }
+        else if (pattern[i] === '*')
+            parts.push([]);
+        else
+            parts.at(-1).push(pattern[i]);
+    }
+    const lits = parts.map(p => p.join(''));
+    if (lits.length === 1)
+        return text === lits[0];
+    if (!text.startsWith(lits[0]) || !text.endsWith(lits.at(-1)) || text.length < lits[0].length + lits.at(-1).length)
+        return false;
+    let at = lits[0].length;
+    const end = text.length - lits.at(-1).length;
+    for (const lit of lits.slice(1, -1)) {
+        const i = text.indexOf(lit, at);
+        if (i < 0 || i + lit.length > end)
+            return false;
+        at = i + lit.length;
+    }
+    return true;
+};
+export class Str {
+    id;
+    length;
+    bits;
+    constructor(id, length, bits) {
+        this.id = id;
+        this.length = length;
+        this.bits = bits;
+    }
+    // The string matches `pattern`, one the kind declared.
+    like(pattern) {
+        const b = this.bits.get(pattern);
+        if (!b)
+            throw new Error(`like("${pattern}"): declare the pattern on the kind (str({like: [...]})); declared: ${[...this.bits.keys()].join(', ') || 'none'}`);
+        return b.eq(1);
+    }
+    get isEmpty() { return this.id.eq(0); }
+    eq(b) {
+        if (typeof b === 'string')
+            return all(this.id.eq(literal(b)), this.length.eq(b.length), ...[...this.bits].map(([p, bit]) => bit.eq(globMatch(p, b) ? 1 : 0)));
+        return all(this.id.eq(b.id), this.length.eq(b.length), ...[...this.bits].filter(([p]) => b.bits.has(p)).map(([p, bit]) => bit.eq(b.bits.get(p))));
+    }
+    ne(b) { return typeof b === 'string' ? this.id.ne(literal(b)) : this.id.ne(b.id); }
+}
+class StrKind extends Kind {
+    patterns;
+    maxLength;
+    constructor(patterns, maxLength) {
+        super();
+        this.patterns = patterns;
+        this.maxLength = maxLength;
+    }
+    bit(name, i) { return `${name}$like${i}`; }
+    vars(name) { return [name, `${name}$len`, ...this.patterns.map((_, i) => this.bit(name, i))]; }
+    assume(name) {
+        return [v(name).eq(0).iff(v(`${name}$len`).eq(0)), ...(this.maxLength === undefined ? [] : [v(`${name}$len`).atMost(this.maxLength)]),
+            ...this.patterns.map((p, i) => (p.replaceAll('\\*', '').includes('*') ? v(this.bit(name, i)).atMost(1) : v(this.bit(name, i)).eq(1).iff(v(name).eq(literal(p.replaceAll('\\*', '*'))))))];
+    }
+    value(name, prefix = '') { return new Str(v(prefix + name), v(`${prefix}${name}$len`), new Map(this.patterns.map((p, i) => [p, v(prefix + this.bit(name, i))]))); }
+    encode(name, raw) {
+        if (typeof raw !== 'string')
+            throw new RangeError(`${name} must be a string, not ${String(raw)}`);
+        if (this.maxLength !== undefined && raw.length > this.maxLength)
+            throw new RangeError(`${name} is at most ${this.maxLength} characters`);
+        return { [name]: intern(raw), [`${name}$len`]: raw.length, ...Object.fromEntries(this.patterns.map((p, i) => [this.bit(name, i), globMatch(p, raw) ? 1 : 0])) };
+    }
+    // Strings drawn so each pattern matches some of them (the patterns with their stars filled), every string named
+    // as a literal (what the rule and its laws compare with), and short strings over their characters.
+    random(name, rand, bound) { return this.encode(name, this.sample(rand, bound)); }
+    sample(rand, bound) {
+        const chars = [...new Set(['a', 'b', ...Array.from(this.patterns.join('').replaceAll('*', ''))])];
+        const pool = [...this.patterns.flatMap(p => [p.replaceAll('*', ''), p.replaceAll('*', chars[rand(chars.length)])]), ...literals];
+        const text = rand(2) === 0 ? pool[rand(pool.length)] : Array.from({ length: rand(Math.min(bound, 4) + 1) }, () => chars[rand(chars.length)]).join('');
+        return this.maxLength === undefined ? text : text.slice(0, this.maxLength);
+    }
+}
+export const str = (opts = {}) => new StrKind(opts.like ?? [], opts.maxLength);
+// A signed integer, encoded as two naturals (the value and `<name>$neg`): at most one nonzero when encoded.
+class IntKind extends Kind {
+    vars(name) { return [name, `${name}$neg`]; }
+    assume() { return []; }
+    value(name, prefix = '') { return new Int(v(prefix + name), v(`${prefix}${name}$neg`)); }
+    encode(name, raw) {
+        if (typeof raw !== 'number' || !Number.isSafeInteger(raw))
+            throw new RangeError(`${name} must be an integer, not ${String(raw)}`);
+        return { [name]: Math.max(raw, 0), [`${name}$neg`]: Math.max(-raw, 0) };
+    }
+    random(name, rand, bound) { const x = rand(2 * bound + 1) - bound; return { [name]: Math.max(x, 0), [`${name}$neg`]: Math.max(-x, 0) }; }
+    sample(rand, bound) { return rand(2 * bound + 1) - bound; }
+}
+export const int = new IntKind();
+// A decimal with `places` places, encoded as its integer count of 10^-places: given as a number or a string ("12.50").
+class DecimalKind extends Kind {
+    places;
+    constructor(places) {
+        super();
+        this.places = places;
+    }
+    vars(name) { return [name, `${name}$neg`]; }
+    assume() { return []; }
+    value(name, prefix = '') { return new Decimal(new Int(v(prefix + name), v(`${prefix}${name}$neg`)), this.places); }
+    encode(name, raw) {
+        if (typeof raw !== 'number' && typeof raw !== 'string')
+            throw new RangeError(`${name} must be a decimal, not ${String(raw)}`);
+        const x = scaledOf(raw, this.places, `a decimal (${name})`);
+        return { [name]: Math.max(x, 0), [`${name}$neg`]: Math.max(-x, 0) };
+    }
+    random(name, rand, bound) { return new IntKind().random(name, rand, bound); }
+    sample(rand, bound) { return (rand(2 * bound * 10 ** this.places + 1) - bound * 10 ** this.places) / 10 ** this.places; }
+}
+export const decimal = (places) => {
+    if (!Number.isInteger(places) || places < 0 || places > 8)
+        throw new RangeError('a decimal has 0 to 8 places');
+    return new DecimalKind(places);
+};
+let boundCounter = 0;
+// A condition at every key: only as a whole flag (`flags: ({...}) => ({covered: everyKey(k => ...)})`), the key read
+// only as a map's key. The kernel closes it (instances where it holds, a witness where it fails).
+export const everyKey = (f) => { const key = `k$${++boundCounter}`; return new Cond({ op: 'all', key, c: f(v(key)).c }, everyOk(scope?.keys, k => f(keyTerm(k)).ok)); };
+// Some key where f holds, in a law or a step law's conclusion (¬∀k. ¬f(k)): proven through a witness, a term naming the
+// key, given here or found by the prover among a few candidates (kernel/prove.ts).
+export const someKey = (f, witness) => {
+    const key = `s$${++boundCounter}`;
+    const none = everyOk(scope?.keys, k => f(keyTerm(k)).not().ok);
+    return new Cond({ op: 'not', x: { op: 'all', key, c: f(v(key)).not().c, ...(witness === undefined ? {} : { witness: termOf(witness) }) } }, none === undefined ? undefined : !none);
+};
 // A map from naturals to naturals, every cell starting at `init`. One write per map per step.
 export class MapRef {
     name;
     init;
+    cells;
     constructor(name, init) {
         this.name = name;
         this.init = init;
+        this.cells = scope?.maps[name];
     }
-    at(key) { return new Term({ op: 'get', map: this.name, key: termOf(key) }); }
-    set(key, value) { return { map: this.name, key: termOf(key), value: termOf(value) }; }
+    at(key) { const k = valOf(key); return new Term({ op: 'get', map: this.name, key: termOf(key) }, this.cells && k !== undefined ? this.cells.cells.get(k) ?? this.cells.dflt : undefined); }
+    set(key, value) { return { map: this.name, key: termOf(key), value: termOf(value), concrete: { key: valOf(key), value: valOf(value) } }; }
     // key's cell plus `by` where `c` holds (the counter every cap keeps).
     bump(key, c = yes, by = 1) { return this.set(key, when(c, this.at(key).plus(by), this.at(key))); }
+    // Every key at once: the value at each key, the key read only as a map's key (Other.at(k)).
+    each(f) { const each = `k$${++boundCounter}`; return { map: this.name, each, value: termOf(f(v(each))), concrete: { at: f } }; }
+    // As a set (cells 0 or 1): a member, and, as whole flags, every member of this one in another, none shared, the same.
+    has(key) { return this.at(key).atLeast(1); }
+    subsetOf(other) { return everyKey(k => this.at(k).atMost(other.at(k))); }
+    disjointFrom(other) { return everyKey(k => this.at(k).plus(other.at(k)).atMost(1)); }
+    sameAs(other) { return everyKey(k => this.at(k).eq(other.at(k))); }
+    // Over a universe of n names (keys 0 .. n − 1): every key past it holds 0 (a law, or a whole flag for a set a request
+    // carries), and the set's size, the sum of its cells there (exact, given `within`).
+    within(n) { naturalConst(n); return everyKey(k => k.atLeast(n).implies(this.at(k).eq(0))); }
+    sizeBelow(n) { naturalConst(n); return sum(0, ...Array.from({ length: n }, (_, key) => this.at(key))); }
+}
+export class ListRef {
+    name;
+    len;
+    cells;
+    constructor(name, len) {
+        this.name = name;
+        this.len = len;
+        this.cells = scope?.maps[name];
+    }
+    at(i) { const k = valOf(i); return new Term({ op: 'get', map: this.name, key: termOf(i) }, this.cells && k !== undefined ? this.cells.cells.get(k) ?? this.cells.dflt : undefined); }
+    // Conditions: x at some position; each position below the next.
+    has(x) { return everyKey(k => k.lt(this.len).implies(this.at(k).ne(x))).not(); }
+    sorted() { return everyKey(k => k.plus(1).lt(this.len).implies(this.at(k).lt(this.at(k.plus(1))))); }
+    // Operations.
+    push(x, when = yes) { return { when, at: k => when_(k.eq(this.len), x, this.at(k)), len: this.len.plus(1) }; }
+    pop(when = yes) { return { when, at: k => when_(k.plus(1).eq(this.len), 0, this.at(k)), len: this.len.minus(1) }; }
+    set(i, x, when = yes) { return { when, at: k => when_(k.eq(i), x, this.at(k)), len: this.len }; }
+    insertAt(i, x, when = yes) { return { when, at: k => when_(k.lt(i), this.at(k), when_(k.eq(i), x, this.at(k.minus(1)))), len: this.len.plus(1) }; }
+    removeAt(i, when = yes) { return { when, at: k => when_(k.lt(i), this.at(k), this.at(k.plus(1))), len: this.len.minus(1) }; }
+    // The updates for the step: the first operation whose condition holds, else the list as it was.
+    apply(...ops) {
+        const each = `k$${++boundCounter}`;
+        const at = (k) => ops.reduceRight((acc, op) => when_(op.when, op.at(k), acc), this.at(k));
+        const len = ops.reduceRight((acc, op) => when_(op.when, op.len, acc), this.len);
+        return { [this.name]: { map: this.name, each, value: at(v(each)).e, concrete: { at } }, [`${this.name}_len`]: len };
+    }
+    // Laws: nothing past the end; positions strictly increasing (so no name twice), as one law about every two keys.
+    within() { return forall(k => this.len.atMost(k).implies(this.at(k).eq(0))); }
+    increasing() { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(this.at(i).lt(this.at(j)))); }
 }
+const when_ = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) }, c.ok === undefined ? undefined : valOf(c.ok ? then : otherwise));
 // A law about every key of a map: proven at a fresh key, assumed at the keys a step reads.
-export const forall = (f) => ({ forall: f });
+// With two parameters or more, about every two keys or more: forall((i, j) => i.lt(j).implies(...)).
+export function forall(f) { return { forall: f }; }
+// The keys a law's callback names: one, or two when it takes two.
+const keysFor = (out) => [`key$${++keyCounter}`, Array.from({ length: Math.max(0, out.forall.length - 1) }, () => `key$${++keyCounter}`)];
 // For histories: `holds` (a <= b, homogeneous over sums and queries) wherever `when` (params and plain inputs) holds.
 export const relation = (holds, whenever = yes) => ({ when: whenever, holds });
+// --- quantifiers anywhere ---------------------------------------------------------------------------------------------
+// The kernel takes a condition at every key as a whole flag only (decided once per step, closed both ways). Written
+// anywhere else in a step (inside another flag, a term's if, a write, the assumption), it is named here as a flag of its
+// own, so every part downstream sees only whole flags. A per-step truth inside such a condition (another quantifier,
+// or a flag) is split out by cases: ∀k. φ(k, q) is (q ∧ ∀k. φ(k, yes)) ∨ (¬q ∧ ∀k. φ(k, no)). A quantifier that reads a
+// key bound outside it is two keys at once, which no flag is.
+const namesIn = (t) => [...JSON.stringify(t).matchAll(/"op":"var","name":"([^"]+)"/g)].map(m => m[1]);
+function swapC(c, from, to) {
+    if (c === from)
+        return to;
+    switch (c.op) {
+        case 'not': return { op: 'not', x: swapC(c.x, from, to) };
+        case 'and':
+        case 'or': return { op: c.op, xs: c.xs.map(y => swapC(y, from, to)) };
+        case 'all': return { op: 'all', key: c.key, c: swapC(c.c, from, to) };
+        case 'flag': return c;
+        case '<':
+        case '<=':
+        case '=': return { ...c, a: swapE(c.a, from, to), b: swapE(c.b, from, to) };
+    }
+}
+function swapE(e, from, to) {
+    switch (e.op) {
+        case 'var':
+        case 'const': return e;
+        case 'mul': return { ...e, a: swapE(e.a, from, to) };
+        case 'if': return { op: 'if', c: swapC(e.c, from, to), then: swapE(e.then, from, to), else: swapE(e.else, from, to) };
+        case 'get': return { ...e, key: swapE(e.key, from, to) };
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return { ...e, a: swapE(e.a, from, to), b: swapE(e.b, from, to) };
+    }
+}
+function perStep(c) {
+    switch (c.op) {
+        case 'flag':
+        case 'all': return c;
+        case 'not': return perStep(c.x);
+        case 'and':
+        case 'or':
+            for (const y of c.xs) {
+                const p = perStep(y);
+                if (p)
+                    return p;
+            }
+            return undefined;
+        case '<':
+        case '<=':
+        case '=': return perStepE(c.a) ?? perStepE(c.b);
+    }
+}
+function perStepE(e) {
+    switch (e.op) {
+        case 'var':
+        case 'const': return undefined;
+        case 'mul': return perStepE(e.a);
+        case 'if': return perStep(e.c) ?? perStepE(e.then) ?? perStepE(e.else);
+        case 'get': return perStepE(e.key);
+        case 'add':
+        case 'sub':
+        case 'min':
+        case 'max':
+        case 'prod': return perStepE(e.a) ?? perStepE(e.b);
+    }
+}
+class Hoister {
+    prefix;
+    flags = {};
+    constructor(prefix) {
+        this.prefix = prefix;
+    }
+    n = 0;
+    // c with every quantifier inside it named as a flag; `bound` the keys bound outside c.
+    cond(c, bound = []) {
+        switch (c.op) {
+            case 'all': return this.quantifier(c, bound);
+            case 'flag': return c;
+            case 'not': return { op: 'not', x: this.cond(c.x, bound) };
+            case 'and':
+            case 'or': return { op: c.op, xs: c.xs.map(y => this.cond(y, bound)) };
+            case '<':
+            case '<=':
+            case '=': return { ...c, a: this.term(c.a, bound), b: this.term(c.b, bound) };
+        }
+    }
+    term(e, bound = []) {
+        switch (e.op) {
+            case 'var':
+            case 'const': return e;
+            case 'mul': return { ...e, a: this.term(e.a, bound) };
+            case 'if': return { op: 'if', c: this.cond(e.c, bound), then: this.term(e.then, bound), else: this.term(e.else, bound) };
+            case 'get': return { ...e, key: this.term(e.key, bound) };
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod': return { ...e, a: this.term(e.a, bound), b: this.term(e.b, bound) };
+        }
+    }
+    // A quantifier as a flag (or, with per-step truths inside, a condition over flags).
+    quantifier(q, bound, name) {
+        const outer = bound.filter(key => namesIn(q).includes(key));
+        if (outer.length)
+            throw new Error(`a condition at every key reads ${outer[0]}, a key bound outside it: two keys at once are outside the kernel`);
+        const inner = perStep(q.c);
+        if (!inner) {
+            const f = name ?? `${this.prefix}${++this.n}`;
+            this.flags[f] = { op: 'all', key: q.key, c: q.c };
+            return { op: 'flag', name: f };
+        }
+        const truth = inner.op === 'flag' ? inner : this.quantifier(inner, [...bound, q.key]);
+        const split = (by) => this.quantifier({ op: 'all', key: q.key, c: swapC(q.c, inner, by) }, bound);
+        return { op: 'or', xs: [{ op: 'and', xs: [truth, split(yes.c)] }, { op: 'and', xs: [{ op: 'not', x: truth }, split(no.c)] }] };
+    }
+}
+// A machine built by hand (or by a combinator) with quantifiers inside its conditions, terms or writes: each named as a
+// flag of its own, as the builders do.
+export function nameQuantifiers(m) {
+    const hoist = new Hoister('all$'), flags = {};
+    const placed = () => { for (const [n, c] of Object.entries(hoist.flags))
+        if (!(n in flags))
+            flags[n] = c; };
+    for (const [n, c] of Object.entries(m.step.flags ?? {})) {
+        const out = c.op === 'all' ? hoist.quantifier(c, [], n) : hoist.cond(c);
+        placed();
+        if (!(n in flags))
+            flags[n] = out;
+    }
+    const state = Object.fromEntries(Object.entries(m.step.state ?? {}).map(([n, e]) => [n, hoist.term(e)]));
+    const maps = Object.fromEntries(Object.entries(m.step.maps ?? {}).map(([n, w]) => [n, 'each' in w ? { each: w.each, value: hoist.term(w.value, [w.each]) } : { key: hoist.term(w.key), value: hoist.term(w.value) }]));
+    const assume = m.assume ? hoist.cond(m.assume) : undefined;
+    placed();
+    return { ...m, step: { ...(Object.keys(flags).length ? { flags } : {}), ...(m.step.state ? { state } : {}), ...(m.step.maps ? { maps } : {}) }, ...(assume ? { assume } : {}) };
+}
+// A law or a step law's conclusion with quantifiers inside, each pulled out as the law's one key: ∀k. A ∧ ∀k. B is
+// ∀k. A ∧ B, and p ∨ ∀k. A is ∀k. p ∨ A when p doesn't read the key. One under an or beside a part that reads the key
+// is two keys at once. A quantifier under a not is some key (someKey), left for the prover's witness.
+const hasForall = (c, positive = true) => c.op === 'all' ? positive || hasForall(c.c, positive) : c.op === 'not' ? hasForall(c.x, !positive) : c.op === 'and' || c.op === 'or' ? c.xs.some(y => hasForall(y, positive)) : false;
+const hasAll = (c) => JSON.stringify(c).includes('"op":"all"');
+function prenex(c, what, key) {
+    let found = false;
+    const walk = (d, positive) => {
+        switch (d.op) {
+            case 'all':
+                if (!positive)
+                    return d;
+                found = true;
+                return walk(substKey(d.c, d.key, key), positive);
+            case 'not': return { op: 'not', x: walk(d.x, !positive) };
+            case 'and':
+            case 'or': {
+                if ((d.op === 'or') === positive && d.xs.some(y => hasForall(y, positive)) && d.xs.filter(y => hasForall(y, positive) || namesIn(y).includes(key)).length > 1)
+                    throw new Error(`${what}: a condition at every key in an or beside another part that reads a key is two keys at once`);
+                return { op: d.op, xs: d.xs.map(y => walk(y, positive)) };
+            }
+            case 'flag': return d;
+            case '<':
+            case '<=':
+            case '=':
+                if (hasAll(d))
+                    throw new Error(`${what}: a condition at every key inside a term is a flag of the rule`);
+                return d;
+        }
+    };
+    const out = walk(c, true);
+    return found ? out : undefined;
+}
+const substKey = (c, from, to) => JSON.parse(JSON.stringify(c).replaceAll(`"op":"var","name":"${from}"`, `"op":"var","name":"${to}"`));
+export const fn = (arity, js, opts = {}) => {
+    if (!Number.isInteger(arity) || arity < 1)
+        throw new Error('a function takes one argument or more');
+    return { arity, js, ...opts };
+};
+// x / c and x mod c, rounded down, for a constant c >= 1: each with its two facts (c·q <= x < c·q + c), which Lean's omega
+// proves of `x / c`.
+export const divBy = (c) => {
+    if (!Number.isSafeInteger(c) || c < 1)
+        throw new RangeError('divBy takes a whole number at least 1');
+    return fn(1, `x => Math.floor(x / ${c})`, { lean: `fun x => x / ${c}`, facts: f => ({
+            [`${c}·q(x) <= x`]: forall(x => f(x).times(c).atMost(x)),
+            [`x < ${c}·q(x) + ${c}`]: forall(x => x.lt(f(x).times(c).plus(c))),
+        }) });
+};
+export const modBy = (c) => {
+    if (!Number.isSafeInteger(c) || c < 1)
+        throw new RangeError('modBy takes a whole number at least 1');
+    // x mod c is below c, and x less it is a multiple of c: x ∸ r = c·q for the q that divBy(c) gives; as facts about r
+    // alone, r <= x, r < c, and r(x + c) = r(x).
+    return fn(1, `x => x % ${c}`, { lean: `fun x => x % ${c}`, facts: f => ({
+            [`r(x) < ${c}`]: forall(x => f(x).lt(c)),
+            [`r(x) <= x`]: forall(x => f(x).atMost(x)),
+            [`r(x + ${c}) = r(x)`]: forall(x => f(x.plus(c)).eq(f(x))),
+        }) });
+};
+const pairE = (a, b) => ({ op: 'if', c: { op: '<', a, b }, then: { op: 'add', a: { op: 'prod', a: b, b }, b: a }, else: { op: 'add', a: { op: 'add', a: { op: 'prod', a, b: a }, b: a }, b } });
+const argsKey = (args) => args.slice(1).reduce(pairE, args[0]);
+// A function's JavaScript as one function of its key: its arguments unpaired (left-nested, as argsKey pairs them).
+const fnSource = (name, d) => {
+    const src = typeof d.js === 'string' ? d.js : String(d.js);
+    let f;
+    try {
+        f = compileFunction([], `return (${src})`)();
+        f(...Array.from({ length: d.arity }, () => 0));
+    }
+    catch (e) {
+        throw new Error(`function ${name}: its js must be a function of its arguments that reads nothing else (${e.message})`);
+    }
+    if (d.arity === 1)
+        return src;
+    return `k => { const u = z => { const s = Math.floor(Math.sqrt(z)); return z - s * s < s ? [z - s * s, s] : [s, z - s * s - s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return (${src})(...a); }`;
+};
+const fnTerm = (name, d) => (...args) => {
+    if (args.length !== d.arity)
+        throw new Error(`function ${name} takes ${d.arity} argument${d.arity === 1 ? '' : 's'}`);
+    const vals = known(args.map(valOf));
+    return new Term({ op: 'get', map: name, key: argsKey(args.map(termOf)) }, vals && fnValueOf(d)(...vals));
+};
+// A function's JavaScript on its arguments themselves (not through the pairing the kernel reads them by).
+const fnValues = new WeakMap();
+const fnValueOf = (d) => {
+    let f = fnValues.get(d);
+    if (!f) {
+        f = typeof d.js === 'function' ? d.js : compileFunction([], `return (${d.js})`)();
+        fnValues.set(d, f);
+    }
+    return f;
+};
 let keyCounter = 0;
+const sources = new WeakMap();
+const withSource = (x, src) => (sources.set(x, src), x);
 // A k-step law's later requests are built over marked names (j:name, which no rule can declare: ':' is reserved); the
 // kernel reads them as name@j.
 const markedName = (name) => { const m = /^(\d+):(.*)$/.exec(name); return m ? `${m[2]}@${m[1]}` : name; };
@@ -240,7 +824,7 @@ const markedE = (e) => {
         case 'prod': return { ...e, a: markedE(e.a), b: markedE(e.b) };
     }
 };
-const marked = (c) => c.op === 'flag' ? c : c.op === 'not' ? { op: 'not', x: marked(c.x) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(marked) } : { ...c, a: markedE(c.a), b: markedE(c.b) };
+const marked = (c) => c.op === 'flag' ? c : c.op === 'all' ? { op: 'all', key: c.key, c: marked(c.c) } : c.op === 'not' ? { op: 'not', x: marked(c.x) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(marked) } : { ...c, a: markedE(c.a), b: markedE(c.b) };
 // P params, I inputs, S state, M maps, F flags, R a history's record, Su its sums, Q its queries: each a record of the
 // values the builders hand out, grown by each call.
 export class Rule {
@@ -257,6 +841,36 @@ export class Rule {
         return this.with({ state: [...this.spec.state, ...Object.entries(init)] });
     }
     maps(init) { return this.with({ maps: [...this.spec.maps, ...Object.entries(init)] }); }
+    // Integers (Int), each starting at an integer or at one over the params; kept as two naturals, <name> and <name>$neg.
+    ints(init) { return this.signedState(init, undefined); }
+    // Decimals with `places` places (Decimal), each starting at a number, a string ("12.50") or one over the params.
+    decimals(places, init) {
+        decimal(places);
+        return this.signedState(init, places);
+    }
+    signedState(init, places) {
+        const parts = (n, x) => {
+            if (typeof x !== 'function') {
+                const i = places === undefined ? Int.of(x) : Int.of(scaledOf(x, places));
+                return [[n, termValue(i.pos)], [`${n}$neg`, termValue(i.neg)]];
+            }
+            const at = (p) => normal(places === undefined ? Int.of(x(p)) : new Decimal(Int.of(0), places).lift(x(p)));
+            return [[n, p => at(p).pos], [`${n}$neg`, p => at(p).neg]];
+        };
+        return this.with({ state: [...this.spec.state, ...Object.entries(init).flatMap(([n, x]) => parts(n, x))], signed: [...(this.spec.signed ?? []), ...Object.keys(init).map(n => [n, places])] });
+    }
+    // Lists, each empty at the start: a map of positions and its length <name>_len (ListRef).
+    lists(...names) {
+        return this.with({ maps: [...this.spec.maps, ...names.map(n => [n, 0])], state: [...this.spec.state, ...names.map(n => [`${n}_len`, 0])], lists: [...(this.spec.lists ?? []), ...names] });
+    }
+    // Functions defined outside the rule (fn, divBy, modBy), read like params that take arguments: f(x).
+    fns(defs) {
+        return this.with({ fns: [...(this.spec.fns ?? []), ...Object.entries(defs)] });
+    }
+    // What is given about the functions (with their own facts): laws over the params and functions, each by name.
+    facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
+    // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
+    carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
     // Named conditions of the step, decided once per step before it; each call's flags may read the earlier calls'. A flag
     // named again replaces the earlier definition in place (what a variant needs: one call, the step unchanged); the new
     // definition may read only the flags defined before the original's place, as the kernel checks.
@@ -288,12 +902,15 @@ export class Rule {
     // (the kernel proves it adds nothing to any query).
     prune(order, after) { return this.with({ prune: { order, after: after } }); }
     // A law about the params, the state, the maps and the sums (not a request): `forall` for every key of a map.
-    law(name, f) {
-        const out = f(this.env({ flags: false, inputs: false, queries: false }));
-        if (out instanceof Cond)
-            return { name, holds: out.c };
+    law(name, f) { return withSource(this.lawOf(name, f(this.env({ flags: false, inputs: false, queries: false }))), { law: f }); }
+    lawOf(name, out) {
         const key = `key$${++keyCounter}`;
-        return { name, forall: key, holds: out.forall(v(key)).c };
+        if (out instanceof Cond) {
+            const p = prenex(out.c, `law ${name}`, key);
+            return p ? { name, forall: key, holds: p } : { name, holds: out.c };
+        }
+        const [k1, more] = keysFor(out), holds = out.forall(v(k1), ...more.map(v)).c;
+        return more.length ? { name, forall: k1, keys: more, holds } : { name, forall: k1, holds: prenex(holds, `law ${name}`, k1) ?? holds };
     }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
     // the request, state, maps, flags, sums, queries) to the state, maps and sums after it. `when` narrows the requests.
@@ -307,11 +924,20 @@ export class Rule {
             after[n] = v(`${n}'`);
         for (const [n, init] of this.spec.maps)
             after[n] = new MapRef(`${n}'`, init);
+        for (const n of this.spec.lists ?? [])
+            after[n] = new ListRef(`${n}'`, v(`${n}_len'`));
+        for (const [n, places] of this.spec.signed ?? []) {
+            after[n] = this.signedValue(n, places, `${n}'`, `${n}$neg'`);
+            delete after[`${n}$neg`];
+        }
         const out = then(env, after), w = when ? { when: when(env).c } : {};
-        if (out instanceof Cond)
-            return { name, then: out.c, ...w };
-        const key = `key$${++keyCounter}`;
-        return { name, forall: key, then: out.forall(v(key)).c, ...w };
+        const key = `key$${++keyCounter}`, src = { step: { then: then, ...(when ? { when: when } : {}) } };
+        if (out instanceof Cond) {
+            const p = prenex(out.c, `step law ${name}`, key);
+            return withSource(p ? { name, forall: key, then: p, ...w } : { name, then: out.c, ...w }, src);
+        }
+        const [k1, more] = keysFor(out), c = out.forall(v(k1), ...more.map(v)).c;
+        return withSource(more.length ? { name, forall: k1, keys: more, then: c, ...w } : { name, forall: k1, then: prenex(c, `step law ${name}`, k1) ?? c, ...w }, src);
     }
     // A law about k steps in a row (k from 2 to 16): `then(first, last, requests)` relates what the first step reads to the
     // state, maps and sums after the last, with each step's request and queries (requests[0] is the first's); `when(before,
@@ -326,6 +952,12 @@ export class Rule {
             after[n] = v(`${n}'`);
         for (const [n, init] of this.spec.maps)
             after[n] = new MapRef(`${n}'`, init);
+        for (const n of this.spec.lists ?? [])
+            after[n] = new ListRef(`${n}'`, v(`${n}_len'`));
+        for (const [n, places] of this.spec.signed ?? []) {
+            after[n] = this.signedValue(n, places, `${n}'`, `${n}$neg'`);
+            delete after[`${n}$neg`];
+        }
         // The j-th request's values over marked names, renamed to the kernel's input@j once built.
         const mark = (j) => `${j}:`;
         const requests = Array.from({ length: k }, (_, j) => {
@@ -338,17 +970,48 @@ export class Rule {
         while (whens.length && whens.at(-1) === undefined)
             whens.pop();
         const w = whens.length ? { when: whens.map(c => (c ?? lit(0).atMost(0)).c) } : {};
-        if (out instanceof Cond)
-            return { name, steps: k, then: marked(out.c), ...w };
         const key = `key$${++keyCounter}`;
-        return { name, steps: k, forall: key, then: marked(out.forall(v(key)).c), ...w };
+        if (out instanceof Cond) {
+            const p = prenex(out.c, `step law ${name}`, key);
+            return p ? { name, steps: k, forall: key, then: marked(p), ...w } : { name, steps: k, then: marked(out.c), ...w };
+        }
+        const [k1, more] = keysFor(out), c = out.forall(v(k1), ...more.map(v)).c;
+        return more.length ? { name, steps: k, forall: k1, keys: more, then: marked(c), ...w } : { name, steps: k, forall: k1, then: marked(prenex(c, `step law ${name}`, k1) ?? c), ...w };
+    }
+    // "Whenever `from` holds, `to` holds later", in every run that takes each helpful request infinitely often: proven by
+    // a rank (a natural over the state and params, or several compared in order) that no step raises while `from` holds
+    // and `to` doesn't, except by reaching `to`, and that each helpful request lowers (or it reaches `to`). A helpful
+    // request names some inputs by terms over the state and params, the rest left free; with several, each comes with the
+    // region where it helps (`when`), some region always holds, and a step that keeps the rank keeps its region.
+    //   queue.leadsTo('every ticket is served', {from: ({t, next, served}) => t.lt(next).and(served.atMost(t)), to: ({t, served}) => served.gt(t),
+    //     rank: ({t, served}) => t.plus(1).minus(served), helpful: () => ({op: 1})})
+    //   batches.leadsTo('every batch is done', {from: () => yes, to: ({waiting, items}) => waiting.eq(0).and(items.eq(0)),
+    //     rank: ({waiting, items}) => [waiting, items], helpful: [{when: ({items}) => items.gt(0), request: () => ({op: 1})}, {when: ({items}) => items.eq(0), request: () => ({op: 0})}]})
+    leadsTo(name, spec) {
+        const env = this.env({ flags: false, inputs: false, queries: false });
+        const req = (f) => Object.fromEntries(Object.entries(f(env)).map(([n, t]) => [n, termOf(t)]));
+        const r = spec.rank(env), rank = Array.isArray(r) ? r.map(termOf) : termOf(r);
+        const base = { name, from: spec.from(env).c, to: spec.to(env).c, rank };
+        return typeof spec.helpful === 'function' ? { ...base, request: req(spec.helpful) } : { ...base, helpful: spec.helpful.map(h => ({ ...(h.when ? { when: h.when(env).c } : {}), request: req(h.request) })) };
     }
-    // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state.
+    // A decision: whenever the params and the request meet `given`, `then` holds. Decisions don't read the state; the
+    // functions' facts are assumed at the arguments the decision reads them at.
     decide(name, given, then) {
         const env = this.env({ flags: false, state: false, queries: false });
         const g = given(env), hyps = [...this.kindAssumptions(), ...this.spec.pre.map(f => f(env).c), ...this.spec.assume.map(f => f(env).c), ...(Array.isArray(g) ? g : [g]).map(c => c.c)];
-        const t = then(env).c;
-        return { name, rule: this, given: hyps, then: t, goal: { name, hyps: [...hyps, { op: 'not', x: t }] } };
+        const t = then(env).c, goal = { name, hyps: [...hyps, { op: 'not', x: t }] };
+        const facts = this.spec.fns?.length || this.spec.facts?.length ? factsFor(this.machine, goal) : [];
+        return withSource({ name, rule: this, given: hyps, then: t, goal: { name, hyps: [...facts, ...goal.hyps] } }, { decision: { given: given, then: then, own: Array.isArray(g) ? g.length : 1 } });
+    }
+    // A decision about two requests under the same params (noninterference, say: requests that differ only in a secret
+    // are decided alike). `given` and `then` read both; the second request's inputs are named b.<input> in a witness.
+    //   r.relate('the secret is irrelevant', (a, b) => a.user.eq(b.user), (a, b) => a.allowed.iff(b.allowed))
+    relate(name, given, then) {
+        const s = this.spec, b = (n) => `b.${n}`, own = [...s.inputs.map(([n]) => n), ...(s.carried ?? [])];
+        const second = (env) => ({ ...env, ...Object.fromEntries(own.map(n => [n, env[b(n)]])) });
+        const pair = new Rule({ ...s, inputs: [...s.inputs, ...s.inputs.map(([n, k]) => [b(n), k])], carried: [...(s.carried ?? []), ...(s.carried ?? []).map(b)],
+            assume: [...s.assume, ...s.assume.map(f => (env) => f(second(env)))], flags: [], step: undefined, record: undefined, sums: [], queries: [], keep: undefined, relations: undefined, prune: undefined });
+        return pair.decide(name, env => given(env, second(env)), env => then(env, second(env)));
     }
     // --- what it compiles to ------------------------------------------------------------------------------------------
     kindAssumptions(which = 'both') {
@@ -356,44 +1019,104 @@ export class Rule {
         const is = which === 'params' ? [] : this.spec.inputs.flatMap(([n, k]) => k.assume(n));
         return [...ps, ...is].map(c => c.c);
     }
+    // A signed state variable's value over these names of its two parts.
+    signedValue(n, places, pos, neg) {
+        const i = new Int(v(pos), v(neg));
+        return places === undefined ? i : new Decimal(i, places);
+    }
     // The values handed to the builders' callbacks.
     env(parts = {}) {
+        this.distinct();
         const out = {};
         for (const [n, k] of this.spec.params)
             out[n] = k.value(n);
-        if (parts.inputs !== false)
+        for (const [n, d] of this.spec.fns ?? [])
+            out[n] = fnTerm(n, d);
+        if (parts.inputs !== false) {
             for (const [n, k] of this.spec.inputs)
                 out[n] = k.value(n);
+            for (const n of this.spec.carried ?? [])
+                out[n] = new MapRef(n, 0);
+        }
         if (parts.state !== false) {
             for (const [n] of this.spec.state)
                 out[n] = v(n);
             for (const [n, init] of this.spec.maps)
                 out[n] = new MapRef(n, init);
+            for (const n of this.spec.lists ?? [])
+                out[n] = new ListRef(n, v(`${n}_len`));
             for (const [n] of this.spec.sums)
                 out[n] = v(n);
+            for (const [n, places] of this.spec.signed ?? []) {
+                out[n] = this.signedValue(n, places, n, `${n}$neg`);
+                delete out[`${n}$neg`];
+            }
         }
         if (parts.queries !== false)
             for (const [n] of this.spec.queries)
                 out[n] = v(n);
         if (parts.flags !== false)
             for (const f of this.spec.flags)
-                for (const n of Object.keys(f(out)))
-                    out[n] = new Cond({ op: 'flag', name: n });
+                for (const n of Object.keys(f(out))) {
+                    if (n in out && !(out[n] instanceof Cond && out[n].c.op === 'flag'))
+                        throw new Error(`${this.spec.name}: ${n} is a flag and ${this.whatIs(n)}`);
+                    out[n] = new Cond({ op: 'flag', name: n }, scope?.flags[n]);
+                }
         return out;
     }
+    // Every name the rule declares is declared once (a flag named again replaces the earlier one, so flags are checked as
+    // they are defined): an input and a state variable sharing a name would hand the callbacks only one of them.
+    names() {
+        const s = this.spec;
+        return [...s.params.map(([n]) => [n, 'a param']), ...(s.fns ?? []).map(([n]) => [n, 'a function']), ...s.inputs.map(([n]) => [n, 'an input']), ...(s.carried ?? []).map(n => [n, 'a carried map']),
+            ...s.state.map(([n]) => [n, 'a state variable']), ...s.maps.map(([n]) => [n, 'a map']), ...s.sums.map(([n]) => [n, 'a sum']), ...s.queries.map(([n]) => [n, 'a query']),
+        ];
+    }
+    whatIs(n) { return this.names().find(([m]) => m === n)?.[1] ?? 'something else'; }
+    distinct() {
+        const seen = new Map();
+        for (const [n, what] of this.names()) {
+            const had = seen.get(n);
+            if (had)
+                throw new Error(`${this.spec.name}: ${n} is ${had} and ${had === what ? 'declared again' : what}; give each a name of its own`);
+            seen.set(n, what);
+        }
+    }
     get machine() {
         const s = this.spec;
         const params = s.params.flatMap(([n, k]) => k.vars(n)), queries = s.queries.map(([n]) => n);
         const inputs = [...s.inputs.flatMap(([n, k]) => k.vars(n)), ...queries];
         const pEnv = this.env({ inputs: false, state: false, flags: false, queries: false });
         const env = this.env({ flags: false });
-        const flags = {};
+        const declared = {};
         for (const f of s.flags)
             for (const [n, c] of Object.entries(f(env))) {
-                flags[n] = c.c;
-                env[n] = new Cond({ op: 'flag', name: n });
-            } // a name again: replaced in place
-        const updates = s.step?.(env) ?? {};
+                if (n in env && !(n in declared))
+                    throw new Error(`${s.name}: ${n} is a flag and ${this.whatIs(n)}`);
+                declared[n] = c.c;
+                env[n] = new Cond({ op: 'flag', name: n }); // a name again: replaced in place
+            }
+        // Quantifiers anywhere, named as flags: each placed before the flag that reads it.
+        const hoist = new Hoister('all$'), flags = {};
+        const placed = () => { for (const [n, c] of Object.entries(hoist.flags))
+            if (!(n in flags))
+                flags[n] = c; };
+        for (const [n, c] of Object.entries(declared)) {
+            const out = c.op === 'all' ? hoist.quantifier(c, [], n) : hoist.cond(c);
+            placed();
+            if (!(n in flags))
+                flags[n] = out;
+        }
+        const updates = { ...s.step?.(env) };
+        // A signed variable's update, as its two parts, normalized.
+        for (const [n, places] of s.signed ?? []) {
+            const u = updates[n];
+            if (u === undefined)
+                continue;
+            const i = normal(places === undefined ? Int.of(u) : new Decimal(Int.of(0), places).lift(u));
+            updates[n] = i.pos;
+            updates[`${n}$neg`] = i.neg;
+        }
         const state = {}, maps = {};
         for (const [n, u] of Object.entries(updates)) {
             if (u === undefined)
@@ -401,20 +1124,30 @@ export class Rule {
             if (typeof u === 'object' && 'map' in u) {
                 if (u.map !== n)
                     throw new Error(`${s.name}: the step writes map ${u.map} under the name ${n}`);
-                maps[n] = { key: u.key, value: u.value };
+                maps[n] = 'each' in u ? { each: u.each, value: hoist.term(u.value, [u.each]) } : { key: hoist.term(u.key), value: hoist.term(u.value) };
             }
             else
-                state[n] = termOf(u);
+                state[n] = hoist.term(termOf(u));
         }
         const pre = [...this.kindAssumptions('params'), ...s.pre.map(f => f(pEnv).c)];
-        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => f(env).c)];
+        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => hoist.cond(f(env).c))];
+        placed();
+        // Functions, and their facts: each function's own (named after it), then the rule's.
+        const fns = Object.fromEntries((s.fns ?? []).map(([n, d]) => [n, { js: fnSource(n, d), ...(d.lean ? { lean: d.lean } : {}) }]));
+        const facts = [
+            ...(s.fns ?? []).flatMap(([n, d]) => Object.entries(d.facts?.(fnTerm(n, d)) ?? {}).map(([name, f]) => this.lawOf(`${n}: ${name}`, f))),
+            ...(s.facts ?? []).flatMap(f => Object.entries(f(pEnv)).map(([name, out]) => this.lawOf(name, out))),
+        ];
         const m = {
             name: s.name, params, inputs,
             state: Object.fromEntries(s.state.map(([n, init]) => [n, typeof init === 'number' ? termOf(init) : termOf(init(pEnv))])),
             ...(s.maps.length ? { maps: Object.fromEntries(s.maps) } : {}),
+            ...(s.carried?.length ? { inputMaps: s.carried } : {}),
             step: { ...(Object.keys(flags).length ? { flags } : {}), ...(Object.keys(state).length ? { state } : {}), ...(Object.keys(maps).length ? { maps } : {}) },
             ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}),
             ...(assume.length ? { assume: assume.length === 1 ? assume[0] : { op: 'and', xs: assume } } : {}),
+            ...(Object.keys(fns).length ? { fns } : {}),
+            ...(facts.length ? { facts } : {}),
         };
         if (s.record) {
             const kinds = new Map(s.inputs);
@@ -435,13 +1168,221 @@ export class Rule {
         }
         return m;
     }
+    // --- the builders checked ------------------------------------------------------------------------------------------
+    // The builders against what they built, on concrete runs: random params and requests by their kinds (`pre` and
+    // `assume` met), and at every state each law's callback, each step law's, every flag and the step itself run again
+    // with every value known, so each answer is the builders' own arithmetic (`val`, `ok`), against the expressions the
+    // interpreter evaluates (core/watch.ts's verdicts, over the same keys). A law that says something other than its
+    // callback, or a step that writes something other than it means, is reported with the state it shows at.
+    crossCheck(laws, stepLaws = [], opts = {}) {
+        const s = this.spec, m = this.machine, run = interpret(m), bound = opts.bound ?? 4, rand = opts.rand ?? seeded(7);
+        let checked = 0;
+        const at = (what, params, st, input) => `${what}: params ${JSON.stringify(params)}, state ${JSON.stringify(this.decode(st))}${input ? `, request ${JSON.stringify(numbersOf(input))}` : ''}`;
+        const mapsOf = (st) => Object.fromEntries(Object.entries(st.maps).map(([n, cells]) => [n, { cells, dflt: st.defaults?.[n] ?? m.maps?.[n] ?? 0 }]));
+        for (let trial = 0; trial < (opts.trials ?? 100); trial++) {
+            const params = this.randomParams(rand, bound);
+            if (m.pre && !evalC(m.pre, params, { scalars: {}, maps: {} }, m))
+                continue;
+            let st = run.init(params);
+            for (let d = 0, tries = 0; d <= (opts.depth ?? 8) && tries < 200; tries++) {
+                // The laws at this state.
+                const keys = keysOf(bound, st), lawScope = { vars: { ...params, ...st.scalars }, maps: mapsOf(st), keys, flags: {} };
+                for (const law of laws) {
+                    const f = sources.get(law)?.law;
+                    if (!f)
+                        continue;
+                    const ok = inScope(lawScope, () => this.verdict(f(this.env({ flags: false, inputs: false, queries: false })), keys));
+                    if (ok === undefined)
+                        continue;
+                    checked++;
+                    if (ok !== watch(m, run, law, params, bound).start(st))
+                        return { checked, failure: at(`law "${law.name}": its callback says ${ok}, the law proven says ${!ok}`, params, st) };
+                }
+                if (d === (opts.depth ?? 8))
+                    break;
+                const input = this.randomInput(rand, bound);
+                if (s.prune || !allowed(m, run, params, st, input))
+                    continue;
+                d++;
+                const next = run.step(params, st, input);
+                if (!s.record) {
+                    const failure = this.crossStep(params, st, input, next, stepLaws, bound, () => checked++);
+                    if (failure)
+                        return { checked, failure: at(failure, params, st, input) };
+                }
+                st = next;
+            }
+        }
+        return { checked };
+    }
+    // A condition's value, or a law about every key's at every tuple of these keys (undefined when not every value is known).
+    verdict(out, keys) {
+        if (out instanceof Cond)
+            return out.ok;
+        const go = (i, picked) => (i === out.forall.length ? out.forall(...picked).ok : everyOk(keys, k => go(i + 1, [...picked, keyTerm(k)])));
+        return go(0, []);
+    }
+    // One step: the flags, the updates and the step laws, each against what the interpreter computed.
+    crossStep(params, st, input, next, stepLaws, bound, count) {
+        const s = this.spec, m = this.machine, run = interpret(m), seen = carriedView(m, st, input), req = requestEnv(m, run, params, st, input);
+        const keys = keysOf(bound, seen, next), vars = { ...params, ...st.scalars, ...req };
+        const sc = { vars, maps: Object.fromEntries(Object.entries(seen.maps).map(([n, cells]) => [n, { cells, dflt: seen.defaults?.[n] ?? m.maps?.[n] ?? 0 }])), keys: exactKeys(keys, vars, seen, next), flags: {} };
+        // Flags: every callback in order, each name's last definition winning, until the values settle (a name defined
+        // again replaces the first in place, so the flags between read the new one).
+        const names = Object.keys(m.step.flags ?? {});
+        for (let pass = 0; pass <= s.flags.length; pass++) {
+            const values = {};
+            inScope(sc, () => {
+                const env = this.env({ flags: false });
+                for (const f of s.flags)
+                    for (const [n, c] of Object.entries(f(env))) {
+                        env[n] = new Cond({ op: 'flag', name: n }, sc.flags[n]);
+                        if (c.ok !== undefined)
+                            values[n] = c.ok;
+                    }
+            });
+            const settled = Object.keys(values).every(n => sc.flags[n] === values[n]);
+            sc.flags = values;
+            if (settled)
+                break;
+        }
+        for (const n of names) {
+            if (sc.flags[n] === undefined || n.startsWith('all$'))
+                continue;
+            count();
+            if (sc.flags[n] !== (req[`?${n}`] === 1))
+                return `flag ${n}: its callback says ${sc.flags[n]}, the step decides ${req[`?${n}`] === 1}`;
+        }
+        // The updates: each written value (an integer's or a decimal's as its count), every scalar not written kept, each map write.
+        const updates = inScope(sc, () => s.step?.(this.env()) ?? {});
+        const signed = new Map(s.signed ?? []);
+        for (const n of Object.keys(st.scalars)) {
+            if (n.endsWith('$neg') && signed.has(n.slice(0, -4)))
+                continue;
+            const u = updates[n], got = signed.has(n) ? next.scalars[n] - next.scalars[`${n}$neg`] : next.scalars[n];
+            let want;
+            if (u === undefined)
+                want = signed.has(n) ? st.scalars[n] - st.scalars[`${n}$neg`] : st.scalars[n];
+            else if (signed.has(n)) {
+                const i = signed.get(n) === undefined ? Int.of(u) : new Decimal(Int.of(0), signed.get(n)).lift(u);
+                want = both(i.pos.val, i.neg.val, (a, b) => a - b);
+            }
+            else
+                want = valOf(u);
+            if (want === undefined)
+                continue;
+            count();
+            if (want !== got)
+                return `the step writes ${n} = ${want} by its callback, ${got} by the machine`;
+        }
+        for (const [n] of s.maps) {
+            const u = updates[n], cell = (k) => next.maps[n]?.get(k) ?? next.defaults?.[n] ?? m.maps[n];
+            if (!u?.concrete)
+                continue;
+            if ('at' in u.concrete) {
+                const f = u.concrete.at;
+                for (const k of sc.keys) {
+                    const want = inScope(sc, () => valOf(f(keyTerm(k))));
+                    if (want === undefined)
+                        continue;
+                    count();
+                    if (want !== cell(k))
+                        return `the step writes ${n}[${k}] = ${want} by its callback, ${cell(k)} by the machine`;
+                }
+            }
+            else if (u.concrete.key !== undefined && u.concrete.value !== undefined) {
+                count();
+                if (u.concrete.value !== cell(u.concrete.key))
+                    return `the step writes ${n}[${u.concrete.key}] = ${u.concrete.value} by its callback, ${cell(u.concrete.key)} by the machine`;
+            }
+        }
+        // Step laws (one step each): `when` and `then` on the state before and after.
+        for (const sl of stepLaws) {
+            const src = sources.get(sl)?.step;
+            if (!src || (sl.steps ?? 1) > 1)
+                continue;
+            const after = { ...sc, keys, vars: { ...sc.vars, ...Object.fromEntries(Object.entries(next.scalars).map(([n, x]) => [`${n}'`, x])) },
+                maps: { ...sc.maps, ...Object.fromEntries(Object.entries(next.maps).map(([n, cells]) => [`${n}'`, { cells, dflt: next.defaults?.[n] ?? m.maps?.[n] ?? 0 }])) } };
+            const ok = inScope(after, () => {
+                const env = this.env(), afterEnv = {};
+                for (const [n] of s.state)
+                    afterEnv[n] = v(`${n}'`);
+                for (const [n] of s.sums)
+                    afterEnv[n] = v(`${n}'`);
+                for (const [n, init] of s.maps)
+                    afterEnv[n] = new MapRef(`${n}'`, init);
+                for (const n of s.lists ?? [])
+                    afterEnv[n] = new ListRef(`${n}'`, v(`${n}_len'`));
+                for (const [n, places] of s.signed ?? []) {
+                    afterEnv[n] = this.signedValue(n, places, `${n}'`, `${n}$neg'`);
+                    delete afterEnv[`${n}$neg`];
+                }
+                const w = src.when ? src.when(env).ok : true;
+                return w === undefined ? undefined : w ? this.verdict(src.then(env, afterEnv), keys) : true;
+            });
+            if (ok === undefined)
+                continue;
+            count();
+            if (ok !== watch(m, run, sl, params, bound).step(st, input, next))
+                return `step law "${sl.name}": its callback says ${ok}, the law proven says ${!ok}`;
+        }
+        return undefined;
+    }
+    // Against the code it describes, step by step: `reference.init(params)` and `reference.step(params, state, request)`,
+    // with requests drawn by their kinds (or `draw`), must hold the same values as the compiled rule (decoded: integers and
+    // decimals as numbers) for every field the reference's state has, after every step of `trials` runs of `depth`.
+    compare(reference, opts = {}) {
+        const s = this.spec, rand = opts.rand ?? seeded(5), bound = opts.bound ?? 100, gen = this.compiled();
+        let checked = 0;
+        const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
+        for (let trial = 0; trial < (opts.trials ?? 200); trial++) {
+            const params = (opts.params?.(rand) ?? sample(s.params)), ps = this.encodeParams(params);
+            let ours = gen.init(ps), theirs = reference.init(params);
+            const edges = trial === 0 ? opts.edges ?? [] : [];
+            for (let d = 0; d < (opts.depth ?? 10) + edges.length; d++) {
+                const request = edges[d] ?? opts.draw?.(rand) ?? sample(s.inputs);
+                ours = gen.step(ps, ours, this.encodeInput(request));
+                theirs = reference.step(params, theirs, request);
+                const got = this.decode(ours);
+                for (const [field, want] of Object.entries(theirs)) {
+                    checked++;
+                    if (got[field] !== want)
+                        return { checked, failure: `${s.name}, params ${JSON.stringify(params)}, after ${JSON.stringify(request)}: ${field} is ${got[field]} here, ${want} in the code it describes` };
+                }
+            }
+        }
+        return { checked };
+    }
     // --- running it -----------------------------------------------------------------------------------------------------
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
-    encodeInput(values) { return encode(this.spec.inputs, values); }
+    // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    encodeInput(values) {
+        const out = encode(this.spec.inputs, values);
+        for (const n of this.spec.carried ?? []) {
+            const given = values[n];
+            out[n] = given instanceof Map ? new Map(given) : new Map([...given].map(key => [key, 1]));
+        }
+        return out;
+    }
     // Random params and inputs that meet their kinds (not the user's `pre` or `assume`, which a caller checks).
     randomParams(rand, bound) { return Object.assign({}, ...this.spec.params.map(([n, k]) => k.random(n, rand, bound))); }
-    randomInput(rand, bound) { return Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound))); }
+    randomInput(rand, bound) {
+        const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
+        for (const n of this.spec.carried ?? [])
+            out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
+        return out;
+    }
+    // The state's scalars as values: an integer's two parts as one signed number, a decimal as its number.
+    decode(st) {
+        const out = { ...st.scalars };
+        for (const [n, places] of this.spec.signed ?? []) {
+            const x = (st.scalars[n] ?? 0) - (st.scalars[`${n}$neg`] ?? 0);
+            out[n] = places === undefined ? x : x / 10 ** places;
+            delete out[`${n}$neg`];
+        }
+        return out;
+    }
     // The prune order's variable, if the history is pruned (a runtime must send it nondecreasing).
     get orderedBy() { return this.spec.prune ? new Map(this.spec.inputs).get(this.spec.prune.order).vars(this.spec.prune.order)[0] : undefined; }
     interpreter() { return interpret(this.machine); }
@@ -451,6 +1392,73 @@ export class Rule {
 }
 const encode = (kinds, values) => Object.assign({}, ...kinds.map(([n, k]) => k.encode(n, values[n])));
 export const rule = (name) => new Rule({ name, params: [], inputs: [], state: [], maps: [], flags: [], pre: [], assume: [], sums: [], queries: [] });
+export class Fun {
+    r;
+    out;
+    constructor(r, out) {
+        this.r = r;
+        this.out = out;
+    }
+    get name() { return this.r.name; }
+    params(kinds) { return new Fun(this.r.params(kinds), this.out); }
+    inputs(kinds) { return new Fun(this.r.inputs(kinds), this.out); }
+    fns(defs) { return new Fun(this.r.fns(defs), this.out); }
+    facts(f) { return new Fun(this.r.facts(f), this.out); }
+    pre(f) { return new Fun(this.r.pre(f), this.out); }
+    assume(f) { return new Fun(this.r.assume(f), this.out); }
+    // The result (replaces an earlier one, so a variant is one call away).
+    returns(f) { return new Fun(this.r, f); }
+    result(env) {
+        if (!this.out)
+            throw new Error(`${this.name}: no result (returns)`);
+        return Object.fromEntries(Object.entries(this.out(env)).map(([k, t]) => [k, t instanceof Cond || t instanceof Int || t instanceof Decimal ? t : new Term(termOf(t))]));
+    }
+    // Whenever the arguments (and the result) meet `given`, the result meets `then`.
+    law(name, given, then) {
+        return this.r.decide(name, env => given(env, this.result(env)), env => then(this.result(env), env));
+    }
+    // A law about two calls under the same params: `then(outA, outB, a, b)` given `given(a, b)` (noninterference, say).
+    relate(name, given, then) {
+        return this.r.relate(name, given, (a, b) => then(this.result(a), this.result(b), a, b));
+    }
+    // Against the code it describes: `reference` called with the same arguments (drawn by their kinds, or by `draw`, the
+    // `edges` first) must return the same value for every field it returns (a field it leaves out is not compared). The
+    // check for an encoding: that the terms here are what the real function computes, on its real inputs.
+    //   cap.compare(({left, local}) => ({out: realCap(left, local)}), {edges: [{left: 2 ** 32 + 5, local: 10}]})
+    compare(reference, opts = {}) {
+        const rand = opts.rand ?? seeded(5), bound = opts.bound ?? 1000, params = (opts.params ?? {}), kinds = this.r['spec'].inputs;
+        let checked = 0;
+        const draws = [...(opts.edges ?? []), ...Array.from({ length: opts.trials ?? 2000 }, () => opts.draw?.(rand) ?? Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)])))];
+        for (const values of draws) {
+            const ours = this.run(values, params), theirs = reference(values, params);
+            for (const [field, want] of Object.entries(theirs)) {
+                checked++;
+                if (ours[field] !== want)
+                    return { checked, failure: `${this.name} at ${JSON.stringify(values)}: ${field} is ${String(ours[field])} here, ${String(want)} in the code it describes` };
+            }
+        }
+        return { checked };
+    }
+    // The one-step rule it compiles to: the result's fields are its state (named out.<field>, apart from the arguments).
+    get rule() {
+        const fields = Object.entries(this.result(this.r['env']({ flags: false, state: false, queries: false })));
+        const name = (k) => `out.${k}`, of = (pick) => Object.fromEntries(fields.filter(([, t]) => pick(t)).map(([k]) => [name(k), 0]));
+        let r = this.r.state(of(t => t instanceof Term || t instanceof Cond)).ints(of(t => t instanceof Int));
+        for (const places of new Set(fields.flatMap(([, t]) => (t instanceof Decimal ? [t.places] : []))))
+            r = r.decimals(places, of(t => t instanceof Decimal && t.places === places));
+        return r.step(env => Object.fromEntries(Object.entries(this.result(env)).map(([k, t]) => [name(k), t instanceof Cond ? count(t) : t])));
+    }
+    compiledRule;
+    // The result at these arguments (and params), from the compiled rule: numbers, and booleans for the conditions.
+    run(values, params = {}) {
+        this.compiledRule ??= (rule => ({ rule, gen: rule.compiled() }))(this.rule);
+        const { rule, gen } = this.compiledRule, ps = rule.encodeParams(params);
+        const kinds = Object.entries(this.result(this.r['env']({ flags: false, state: false, queries: false })));
+        const st = rule.decode(gen.step(ps, gen.init(ps), rule.encodeInput(values)));
+        return Object.fromEntries(kinds.map(([k, t]) => [k, t instanceof Cond ? st[`out.${k}`] === 1 : st[`out.${k}`]]));
+    }
+}
+export const fun = (name) => new Fun(rule(name));
 // A loop runs `body` while `while` holds, each turn with fresh inputs; it halts if a rank over the state and params
 // (or a tuple of them, compared in order) drops on every turn.
 export class LoopRule {
@@ -509,18 +1517,48 @@ const goalsVerdict = (goals) => {
     for (const g of goals) {
         const out = grow(g);
         if (!('tree' in out))
-            return { proven: false, checked: false, goal: g.name, stuck: out.stuck, ...(out.witness ? { witness: out.witness } : {}) };
+            return { proven: false, checked: false, goal: g.name, stuck: out.stuck, ...(out.witness ? { witness: out.witness } : {}), ...(out.why ? { why: out.why } : {}) };
         trees[g.name] = out.tree;
     }
     return { proven: true, checked: goals.every(g => check(g, trees[g.name])), trees };
 };
 export function proveRule(r, laws) {
     const out = proveLaws(r.machine, laws);
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}) } : {}) };
+    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveSteps(r, laws, stepLaws) {
     const out = proveStepLaws(r.machine, laws, stepLaws);
-    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}) } : {}) };
+    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
+}
+export function proveLeadsTo(r, laws, l) {
+    const out = proveLiveness(r.machine, laws, l);
+    return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export const proveDecision = (d) => goalsVerdict([d.goal]);
+const seeded = (seed) => { let x = seed; return k => { x = (x * 1103515245 + 12345) % 2 ** 31; return Math.floor(x / 2 ** 31 * k); }; };
+// A decision's callbacks against its condition, on random params and requests: `given` and `then` each run with every
+// value known, against what the interpreter evaluates of the decision built from them.
+export function crossCheckDecision(d, opts = {}) {
+    const src = sources.get(d)?.decision;
+    if (!src)
+        return { checked: 0 };
+    const r = d.rule, m = r.machine, bound = opts.bound ?? 4, rand = opts.rand ?? seeded(11), own = d.given.slice(d.given.length - src.own);
+    let checked = 0;
+    for (let i = 0; i < (opts.trials ?? 500); i++) {
+        const input = r.randomInput(rand, bound), values = { ...r.randomParams(rand, bound), ...numbersOf(input) };
+        const st = { scalars: {}, maps: Object.fromEntries(Object.entries(input).filter((e) => typeof e[1] !== 'number').map(([n, cells]) => [n, new Map(cells)])) };
+        const keys = exactKeys(keysOf(bound, st), values, st);
+        const sc = { vars: values, maps: Object.fromEntries(Object.entries(st.maps).map(([n, cells]) => [n, { cells, dflt: 0 }])), keys, flags: {} };
+        const [g, t] = inScope(sc, () => { const env = r['env']({ flags: false, state: false, queries: false }), g = src.given(env); return [all(...(Array.isArray(g) ? g : [g])).ok, src.then(env).ok]; });
+        for (const [what, ok, c] of [['given', g, own], ['then', t, [d.then]]]) {
+            if (ok === undefined)
+                continue;
+            checked++;
+            const want = c.every(x => evalC(x, values, st, m));
+            if (ok !== want)
+                return { checked, failure: `decision "${d.name}": its ${what} callback says ${ok}, the decision proven says ${want}, at ${JSON.stringify(values)}` };
+        }
+    }
+    return { checked };
+}
 export const proveLoop = (l, laws) => goalsVerdict(loopObligations(l.loop, laws, l.rankTerms));