gdp-wired 0.7.0 → 0.9.0

package/dist/core/dsl.js

@@ -84,6 +84,16 @@ export const max = (a, b) => new Term({ op: 'max', a: termOf(a), b: termOf(b) },
 export function when(c, then, otherwise) {
     if (then instanceof Cond && otherwise instanceof Cond)
         return choose(c, then, otherwise);
+    if (then instanceof Variant && otherwise instanceof Variant) {
+        if (then.kind.names.join() !== otherwise.kind.names.join())
+            throw new Error('when: variants of other cases');
+        return new Variant(when(c, then.tag, otherwise.tag), Object.fromEntries(then.kind.names.map(k => [k, when(c, then.cases[k], otherwise.cases[k])])), then.kind);
+    }
+    if (isRecord(then) && isRecord(otherwise)) {
+        if (Object.keys(then).sort().join() !== Object.keys(otherwise).sort().join())
+            throw new Error('when: records of other fields');
+        return Object.fromEntries(Object.keys(then).map(f => [f, when(c, then[f], otherwise[f])]));
+    }
     if (then instanceof Choice && otherwise instanceof Choice)
         return new Choice(when(c, then.n, otherwise.n), then.values);
     if (then instanceof Str && otherwise instanceof Str)
@@ -105,12 +115,53 @@ function pickNumbers(c, then, otherwise) {
 }
 // A condition by cases: `then` where c holds, `otherwise` elsewhere.
 export const choose = (c, then, otherwise) => any(all(c, then), all(c.not(), otherwise));
+// A record's value: a plain object of its fields' values (not a term, a condition or another value of a kind).
+const isRecord = (x) => typeof x === 'object' && x !== null && Object.getPrototypeOf(x) === Object.prototype;
+// The same value, part by part: numbers equal, conditions both or neither, choices and strings alike, an optional value
+// missing in both or present in both and the same, a variant in the same case with the same fields, a record field by
+// field.
+export function same(a, b) {
+    if (a instanceof Cond && b instanceof Cond)
+        return a.iff(b);
+    if (a instanceof Choice && b instanceof Choice)
+        return a.n.eq(b.n);
+    if (a instanceof Str && b instanceof Str)
+        return a.eq(b);
+    if (a instanceof Decimal)
+        return a.eq(b);
+    if (b instanceof Decimal)
+        return b.eq(a);
+    if (a instanceof Int)
+        return a.eq(b);
+    if (b instanceof Int)
+        return b.eq(a);
+    if (a instanceof Maybe && b instanceof Maybe)
+        return all(a.present.eq(b.present), a.isNone.or(same(a.inner, b.inner)));
+    if (a instanceof Variant && b instanceof Variant) {
+        if (a.kind.names.join() !== b.kind.names.join())
+            throw new Error('same: variants of other cases');
+        return all(a.tag.eq(b.tag), ...a.kind.names.filter(k => Object.keys(a.cases[k]).length).map(k => a.is(k).implies(same(a.cases[k], b.cases[k]))));
+    }
+    if (isRecord(a) && isRecord(b)) {
+        if (Object.keys(a).sort().join() !== Object.keys(b).sort().join())
+            throw new Error('same: records of other fields');
+        return all(...Object.keys(a).map(f => same(a[f], b[f])));
+    }
+    if ((a instanceof Term || typeof a === 'number') && (b instanceof Term || typeof b === 'number'))
+        return (typeof a === 'number' ? lit(a) : a).eq(b);
+    throw new Error('same: two values of one kind');
+}
 // 1 where c holds, else 0: what a sum over a history adds per record.
 export const count = (c) => when(c, 1, 0);
 export const sum = (first, ...rest) => rest.reduce((acc, t) => acc.plus(t), typeof first === 'number' ? lit(first) : first);
 const named = (at, n) => (typeof at === 'string' ? at + n : at(n));
 const primed = (n) => `${n}'`;
 export class Kind {
+    value(name, at = '') { return this.build(name, part => v(named(at, part))); }
+    // What every value a step writes keeps true of its variables (a flag is 0 or 1, a choice or a case in range, a
+    // presence bit 0 or 1), unlike a bound such as upTo's, which a step may pass: the laws a rule's state and cells of the
+    // kind are proven to keep (Rule.kindLaws).
+    invariant(_value) { return []; }
     // A runtime value of the kind (what encode takes), for comparing a rule with the code it describes (compare).
     sample(_rand, _bound) { throw new Error('this kind draws no runtime values'); }
     // A state variable of this kind starting at a runtime value, or at a value over the params: `.state({open: bool.from(true)})`.
@@ -235,7 +286,7 @@ export class Decimal {
 }
 const asNat = (name, raw) => {
     if (typeof raw !== 'number' || !Number.isSafeInteger(raw) || raw < 0)
-        throw new RangeError(`${name} must be a natural, not ${String(raw)}`);
+        throw new RangeError(`${name} must be a natural, not ${shown(raw)}`);
     return raw;
 };
 class NatKind extends Kind {
@@ -246,7 +297,7 @@ class NatKind extends Kind {
     }
     vars(name) { return [name]; }
     assume(name) { return this.maxValue === undefined ? [] : [v(name).atMost(this.maxValue)]; }
-    value(name, at = '') { return v(named(at, name)); }
+    build(name, get) { return get(name); }
     store(name, value) { return { [name]: value }; }
     decode(name, vars) { return vars[name]; }
     empty() { return 0; }
@@ -273,7 +324,8 @@ export class Bool extends Cond {
 class BoolKind extends Kind {
     vars(name) { return [name]; }
     assume(name) { return [v(name).atMost(1)]; }
-    value(name, at = '') { return new Bool(v(named(at, name))); }
+    build(name, get) { return new Bool(get(name)); }
+    invariant(b) { return [b.n.atMost(1)]; }
     store(name, value) { return { [name]: typeof value === 'boolean' ? (value ? 1 : 0) : count(value) }; }
     decode(name, vars) { return vars[name] === 1; }
     empty() { return false; }
@@ -282,7 +334,7 @@ class BoolKind extends Kind {
             return { [name]: raw ? 1 : 0 };
         if (raw === 0 || raw === 1)
             return { [name]: raw };
-        throw new RangeError(`${name} must be a boolean, not ${String(raw)}`);
+        throw new RangeError(`${name} must be a boolean, not ${shown(raw)}`);
     }
     random(name, rand) { return { [name]: rand(2) }; }
     sample(rand) { return rand(2) === 1; }
@@ -322,14 +374,15 @@ class OneOfKind extends Kind {
     }
     vars(name) { return [name]; }
     assume(name) { return [v(name).lt(this.values.length)]; }
-    value(name, at = '') { return new Choice(v(named(at, name)), this.values); }
+    build(name, get) { return new Choice(get(name), this.values); }
+    invariant(c) { return [c.n.lt(this.values.length)]; }
     store(name, value) { return { [name]: value instanceof Choice ? value.n : this.encode(name, value)[name] }; }
     decode(name, vars) { return this.values[vars[name]]; }
     empty() { return this.values[0]; }
     encode(name, raw) {
         const i = this.values.indexOf(raw);
         if (i < 0)
-            throw new RangeError(`${name} is one of ${this.values.join(', ')}, not ${String(raw)}`);
+            throw new RangeError(`${name} is one of ${this.values.join(', ')}, not ${shown(raw)}`);
         return { [name]: i };
     }
     random(name, rand) { return { [name]: rand(this.values.length) }; }
@@ -366,7 +419,8 @@ class MaybeKind extends Kind {
     has(name) { return `${name}$some`; }
     vars(name) { return [this.has(name), ...this.of.vars(name)]; }
     assume(name) { return [v(this.has(name)).atMost(1), ...this.of.assume(name)]; }
-    value(name, at = '') { return new Maybe(v(named(at, this.has(name))), this.of.value(name, at)); }
+    build(name, get) { return new Maybe(get(this.has(name)), this.of.build(name, get)); }
+    invariant(m) { return [m.present.atMost(1), ...this.of.invariant(m.inner)]; }
     // null for none, a Maybe as it is, any other value as some.
     store(name, value) {
         if (value === null || value === undefined)
@@ -388,6 +442,168 @@ class MaybeKind extends Kind {
     sample(rand, bound) { return rand(4) === 0 ? null : this.of.sample(rand, bound); }
 }
 export const maybe = (of) => new MaybeKind(of);
+// A value present where c holds and missing elsewhere (a function's result that may be missing, say).
+export const optional = (c, value) => new Maybe(count(c), value);
+const fieldName = (name, f) => `${name}.${f}`;
+const plainFields = (what, names) => { for (const f of names)
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+        throw new Error(`${what}: ${f} is not a plain field name`); };
+const rawObject = (name, raw, what) => {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        throw new RangeError(`${name} must be ${what}, not ${String(raw)}`);
+    return raw;
+};
+// Runtime values alike: objects field by field.
+const sameRaw = (a, b) => {
+    if (a === b)
+        return true;
+    if (typeof a !== 'object' || typeof b !== 'object' || a === null || b === null)
+        return false;
+    const ka = Object.keys(a), kb = Object.keys(b);
+    return ka.length === kb.length && ka.every(k => sameRaw(a[k], b[k]));
+};
+const shown = (x) => (typeof x === 'object' && x !== null ? JSON.stringify(x) : String(x));
+// r.<field> is a history record's field to the runtimes.
+const composite = (name) => { if (name === 'r')
+    throw new Error('r names a history record; give the record or variant another name'); };
+const merged = (parts) => Object.assign({}, ...parts);
+class RecordKind extends Kind {
+    fields;
+    names;
+    constructor(fields) {
+        super();
+        this.fields = fields;
+        this.names = Object.keys(fields);
+        if (this.names.length === 0)
+            throw new Error('a record has a field');
+        plainFields('record', this.names);
+    }
+    each(f) { return this.names.map(n => f(n, this.fields[n])); }
+    vars(name) { composite(name); return this.each((f, k) => k.vars(fieldName(name, f))).flat(); }
+    assume(name) { return this.each((f, k) => k.assume(fieldName(name, f))).flat(); }
+    build(name, get) { return Object.fromEntries(this.each((f, k) => [f, k.build(fieldName(name, f), get)])); }
+    invariant(r) { return this.each((f, k) => k.invariant(r[f])).flat(); }
+    store(name, value) {
+        const o = value;
+        if (o === null || typeof o !== 'object')
+            throw new Error(`${name}: a record is written as an object of its fields`);
+        for (const f of Object.keys(o))
+            if (!(f in this.fields))
+                throw new Error(`${name}: the record has no field ${f}`);
+        return Object.assign({}, ...this.each((f, k) => { if (!(f in o))
+            throw new Error(`${name}: the write leaves out the field ${f}`); return k.store(fieldName(name, f), o[f]); }));
+    }
+    decode(name, vars) { return Object.fromEntries(this.each((f, k) => [f, k.decode(fieldName(name, f), vars)])); }
+    empty() { return Object.fromEntries(this.each((f, k) => [f, k.empty()])); }
+    encode(name, raw) {
+        const o = rawObject(name, raw, `an object with the fields ${this.names.join(', ')}`);
+        for (const f of Object.keys(o))
+            if (!(f in this.fields))
+                throw new RangeError(`${name} has no field ${f}`);
+        return merged(this.each((f, k) => k.encode(fieldName(name, f), o[f])));
+    }
+    random(name, rand, bound) { return merged(this.each((f, k) => k.random(fieldName(name, f), rand, bound))); }
+    sample(rand, bound) { return Object.fromEntries(this.each((f, k) => [f, k.sample(rand, bound)])); }
+}
+export const record = (fields) => new RecordKind(fields);
+export class Variant {
+    tag;
+    cases;
+    kind;
+    constructor(tag, cases, kind) {
+        this.tag = tag;
+        this.cases = cases;
+        this.kind = kind;
+    }
+    is(k) { return this.tag.eq(this.kind.index(k)); }
+    match(cases) {
+        const results = this.kind.names.map(k => [k, cases[k](this.cases[k])]);
+        if (results.every(([, r]) => r instanceof Cond))
+            return any(...results.map(([k, r]) => all(this.is(k), r)));
+        // The last case is what's left: the kind's assumption says the index is below the number of cases.
+        return results.slice(0, -1).reduceRight((acc, [k, r]) => when(this.is(k), r, acc), results.at(-1)[1]);
+    }
+}
+export class VariantKind extends Kind {
+    cases;
+    tagKey;
+    names;
+    constructor(cases, tagKey) {
+        super();
+        this.cases = cases;
+        this.tagKey = tagKey;
+        this.names = Object.keys(cases);
+        if (this.names.length === 0)
+            throw new Error('a variant has a case');
+        plainFields('variant', this.names);
+        for (const k of this.names) {
+            plainFields(`variant case ${k}`, Object.keys(cases[k]));
+            if (tagKey in cases[k])
+                throw new Error(`variant case ${k}: ${tagKey} names the case, not a field`);
+        }
+    }
+    index(k) {
+        const i = this.names.indexOf(k);
+        if (i < 0)
+            throw new Error(`${k} is not a case of ${this.names.join(', ')}`);
+        return i;
+    }
+    payload(k) { return new RecordKind(this.cases[k]); }
+    filled(k) { return Object.keys(this.cases[k]).length > 0; }
+    at(name, k) { return fieldName(name, k); }
+    vars(name) { composite(name); return [name, ...this.names.filter(k => this.filled(k)).flatMap(k => this.payload(k).vars(this.at(name, k)))]; }
+    assume(name) { return [v(name).lt(this.names.length), ...this.names.filter(k => this.filled(k)).flatMap(k => this.payload(k).assume(this.at(name, k)))]; }
+    build(name, get) {
+        return new Variant(get(name), Object.fromEntries(this.names.map(k => [k, this.filled(k) ? this.payload(k).build(this.at(name, k), get) : {}])), this);
+    }
+    // The value of a case with these fields (terms, values or runtime values), to compare, match or pass to `when`:
+    //   when(held, At.make({tag: 'holding', amount, since: now}), at)
+    invariant(x) { return [x.tag.lt(this.names.length), ...this.names.filter(k => this.filled(k)).flatMap(k => this.payload(k).invariant(x.cases[k]))]; }
+    make(write) {
+        const parts = this.store('$', write);
+        return this.build('$', part => { const t = parts[part]; return typeof t === 'number' ? lit(t) : t; });
+    }
+    // A Variant of this kind as it is, or {tag: case, ...fields} (fields as values or runtime values): the other cases'
+    // fields are written empty.
+    store(name, value) {
+        if (value instanceof Variant) {
+            if (value.kind.names.join() !== this.names.join())
+                throw new Error(`${name}: a variant of other cases is written`);
+            return { [name]: value.tag, ...Object.assign({}, ...this.names.filter(k => this.filled(k)).map(k => this.payload(k).store(this.at(name, k), value.cases[k]))) };
+        }
+        const o = value, k = o?.[this.tagKey];
+        if (typeof k !== 'string')
+            throw new Error(`${name}: a variant is written as {${this.tagKey}: case, ...fields}`);
+        const { [this.tagKey]: _, ...fields } = o;
+        return { [name]: this.index(k), ...Object.assign({}, ...this.names.filter(c => this.filled(c)).map(c => this.payload(c).store(this.at(name, c), c === k ? fields : this.payload(c).empty()))) };
+    }
+    decode(name, vars) {
+        const k = this.names[vars[name]];
+        return { [this.tagKey]: k, ...(this.filled(k) ? this.payload(k).decode(this.at(name, k), vars) : {}) };
+    }
+    empty() { const k = this.names[0]; return { [this.tagKey]: k, ...(this.filled(k) ? this.payload(k).empty() : {}) }; }
+    encode(name, raw) {
+        const o = rawObject(name, raw, `an object whose ${this.tagKey} is one of ${this.names.join(', ')}`), k = o[this.tagKey];
+        if (typeof k !== 'string' || !this.names.includes(k))
+            throw new RangeError(`${name}.${this.tagKey} is one of ${this.names.join(', ')}, not ${shown(k)}`);
+        const { [this.tagKey]: _, ...fields } = o;
+        if (!this.filled(k) && Object.keys(fields).length)
+            throw new RangeError(`${name}: the case ${k} has no fields`);
+        const zeros = (c) => Object.fromEntries(this.payload(c).vars(this.at(name, c)).map(n => [n, 0]));
+        return { [name]: this.index(k), ...merged(this.names.filter(c => this.filled(c)).map(c => (c === k ? this.payload(c).encode(this.at(name, c), fields) : zeros(c)))) };
+    }
+    random(name, rand, bound) {
+        const i = rand(this.names.length);
+        return { [name]: i, ...merged(this.names.filter(c => this.filled(c)).map(c => this.payload(c).random(this.at(name, c), rand, bound))) };
+    }
+    sample(rand, bound) { const k = this.names[rand(this.names.length)]; return { [this.tagKey]: k, ...(this.filled(k) ? this.payload(k).sample(rand, bound) : {}) }; }
+}
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function variant(cases, opts = {}) {
+    if (opts.tag !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(opts.tag))
+        throw new Error(`variant: ${opts.tag} is not a plain key`);
+    return new VariantKind(cases, opts.tag ?? 'tag');
+}
 // A string, encoded as its interned name, its length and one bit per pattern the kind declares (`like`, Cedar's glob:
 // `*` any run of characters, `\*` a star): all computed from the string itself when the input is encoded, so the bits
 // are the string's, not an answer someone supplies. Names come from one table per process, the empty string 0; a law
@@ -480,7 +696,7 @@ class StrKind extends Kind {
         return [v(name).eq(0).iff(v(`${name}$len`).eq(0)), ...(this.maxLength === undefined ? [] : [v(`${name}$len`).atMost(this.maxLength)]),
             ...this.patterns.map((p, i) => (p.replaceAll('\\*', '').includes('*') ? v(this.bit(name, i)).atMost(1) : v(this.bit(name, i)).eq(1).iff(v(name).eq(literal(p.replaceAll('\\*', '*'))))))];
     }
-    value(name, at = '') { return new Str(v(named(at, name)), v(named(at, `${name}$len`)), new Map(this.patterns.map((p, i) => [p, v(named(at, this.bit(name, i)))]))); }
+    build(name, get) { return new Str(get(name), get(`${name}$len`), new Map(this.patterns.map((p, i) => [p, get(this.bit(name, i))]))); }
     store(name, value) {
         if (typeof value === 'string')
             return { [name]: literal(value), [`${name}$len`]: value.length, ...Object.fromEntries(this.patterns.map((p, i) => [this.bit(name, i), globMatch(p, value) ? 1 : 0])) };
@@ -493,7 +709,7 @@ class StrKind extends Kind {
     empty() { return ''; }
     encode(name, raw) {
         if (typeof raw !== 'string')
-            throw new RangeError(`${name} must be a string, not ${String(raw)}`);
+            throw new RangeError(`${name} must be a string, not ${shown(raw)}`);
         if (this.maxLength !== undefined && raw.length > this.maxLength)
             throw new RangeError(`${name} is at most ${this.maxLength} characters`);
         return { [name]: intern(raw), [`${name}$len`]: raw.length, ...Object.fromEntries(this.patterns.map((p, i) => [this.bit(name, i), globMatch(p, raw) ? 1 : 0])) };
@@ -513,13 +729,13 @@ export const str = (opts = {}) => new StrKind(opts.like ?? [], opts.maxLength);
 class IntKind extends Kind {
     vars(name) { return [name, `${name}$neg`]; }
     assume() { return []; }
-    value(name, at = '') { return new Int(v(named(at, name)), v(named(at, `${name}$neg`))); }
+    build(name, get) { return new Int(get(name), get(`${name}$neg`)); }
     store(name, value) { const i = normal(Int.of(value)); return { [name]: i.pos, [`${name}$neg`]: i.neg }; }
     decode(name, vars) { return vars[name] - vars[`${name}$neg`]; }
     empty() { return 0; }
     encode(name, raw) {
         if (typeof raw !== 'number' || !Number.isSafeInteger(raw))
-            throw new RangeError(`${name} must be an integer, not ${String(raw)}`);
+            throw new RangeError(`${name} must be an integer, not ${shown(raw)}`);
         return { [name]: Math.max(raw, 0), [`${name}$neg`]: Math.max(-raw, 0) };
     }
     random(name, rand, bound) { const x = rand(2 * bound + 1) - bound; return { [name]: Math.max(x, 0), [`${name}$neg`]: Math.max(-x, 0) }; }
@@ -535,7 +751,7 @@ class DecimalKind extends Kind {
     }
     vars(name) { return [name, `${name}$neg`]; }
     assume() { return []; }
-    value(name, at = '') { return new Decimal(new Int(v(named(at, name)), v(named(at, `${name}$neg`))), this.places); }
+    build(name, get) { return new Decimal(new Int(get(name), get(`${name}$neg`)), this.places); }
     store(name, value) {
         const i = normal(typeof value === 'string' ? Int.of(scaledOf(value, this.places)) : new Decimal(Int.of(0), this.places).lift(value));
         return { [name]: i.pos, [`${name}$neg`]: i.neg };
@@ -544,7 +760,7 @@ class DecimalKind extends Kind {
     empty() { return 0; }
     encode(name, raw) {
         if (typeof raw !== 'number' && typeof raw !== 'string')
-            throw new RangeError(`${name} must be a decimal, not ${String(raw)}`);
+            throw new RangeError(`${name} must be a decimal, not ${shown(raw)}`);
         const x = scaledOf(raw, this.places, `a decimal (${name})`);
         return { [name]: Math.max(x, 0), [`${name}$neg`]: Math.max(-x, 0) };
     }
@@ -624,6 +840,64 @@ export class ListRef {
     increasing() { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(this.at(i).lt(this.at(j)))); }
 }
 const when_ = (c, then, otherwise) => new Term({ op: 'if', c: c.c, then: termOf(then), else: termOf(otherwise) }, c.ok === undefined ? undefined : valOf(c.ok ? then : otherwise));
+const isPartsWrite = (u) => typeof u === 'object' && u !== null && 'parts' in u;
+// The parts of a value written at a cell, by the names of the maps they go to.
+const partsOf = (kind, name, value) => kind.store(name, value);
+// A map whose cells hold values of a kind (a record, a variant, a choice...): one map per variable of the kind
+// (<name>.<field>, and the case's index as <name> for a variant), every cell starting at the kind's value given by
+// `from`. `at(k)` is the value at k, read as the kind's value is; `set` and `each` write whole values.
+//   .maps({Acct: record({limit: nat, blocked: bool}).from({limit: 0, blocked: false})})
+//   .step(({who, Acct}) => ({Acct: Acct.set(who, {limit: 10, blocked: false})}))
+export class CellsRef {
+    name;
+    kind;
+    map;
+    constructor(name, kind, map) {
+        this.name = name;
+        this.kind = kind;
+        this.map = map;
+    }
+    at(key) { return this.kind.build(this.name, part => this.map(part).at(key)); }
+    set(key, value) {
+        const parts = partsOf(this.kind, this.name, value);
+        return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).set(key, parts[part])])) };
+    }
+    // Every key at once (the key read only as a map's key).
+    each(f) {
+        return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).each(k => partsOf(this.kind, this.name, f(k))[part])])) };
+    }
+}
+export class ItemsRef {
+    name;
+    kind;
+    len;
+    list;
+    constructor(name, kind, len, list) {
+        this.name = name;
+        this.kind = kind;
+        this.len = len;
+        this.list = list;
+    }
+    get names() { return this.kind.vars(this.name); }
+    at(i) { return this.kind.build(this.name, part => this.list(part).at(i)); }
+    // x at some position.
+    has(x) { return everyKey(k => k.lt(this.len).implies(same(this.at(k), x).not())).not(); }
+    op(when, len, f) { return { when, len, parts: Object.fromEntries(this.names.map(part => [part, f(this.list(part), part)])) }; }
+    push(x, when = yes) { const p = partsOf(this.kind, this.name, x); return this.op(when, this.len.plus(1), (l, part) => l.push(p[part], when)); }
+    pop(when = yes) { return this.op(when, this.len.minus(1), l => l.pop(when)); }
+    set(i, x, when = yes) { const p = partsOf(this.kind, this.name, x); return this.op(when, this.len, (l, part) => l.set(i, p[part], when)); }
+    insertAt(i, x, when = yes) { const p = partsOf(this.kind, this.name, x); return this.op(when, this.len.plus(1), (l, part) => l.insertAt(i, p[part], when)); }
+    removeAt(i, when = yes) { return this.op(when, this.len.minus(1), l => l.removeAt(i, when)); }
+    apply(...ops) {
+        const parts = {};
+        for (const part of this.names)
+            parts[part] = this.list(part).apply(...ops.map(op => op.parts[part]))[part];
+        return { [this.name]: { parts }, [`${this.name}_len`]: ops.reduceRight((acc, op) => when_(op.when, op.len, acc), this.len) };
+    }
+    // Laws: nothing past the end; the items in strictly increasing order of `by`.
+    within() { return forall(k => this.len.atMost(k).implies(all(...this.names.map(part => this.list(part).at(k).eq(0))))); }
+    increasing(by) { return forall((i, j) => i.lt(j).and(j.lt(this.len)).implies(by(this.at(i)).lt(by(this.at(j))))); }
+}
 // A law about every key of a map: proven at a fresh key, assumed at the keys a step reads.
 // With two parameters or more, about every two keys or more: forall((i, j) => i.lt(j).implies(...)).
 export function forall(f) { return { forall: f }; }
@@ -827,7 +1101,142 @@ export const modBy = (c) => {
             [`r(x + ${c}) = r(x)`]: forall(x => f(x.plus(c)).eq(f(x))),
         }) });
 };
-const pairE = (a, b) => ({ op: 'if', c: { op: '<', a, b }, then: { op: 'add', a: { op: 'prod', a: b, b }, b: a }, else: { op: 'add', a: { op: 'add', a: { op: 'prod', a, b: a }, b: a }, b } });
+const reservedInRecur = ['x', 'fx', 'y', 'fy', 'prev', 'x0', 'fx0'];
+export const recur = (name, def, lemmas = {}, between = {}) => {
+    const plain = /^[A-Za-z][A-Za-z0-9_]*$/;
+    if (!plain.test(name))
+        throw new Error(`recur: ${name} is not a plain name (it names the Lean definition)`);
+    const args = [...(def.args ?? [])], uses = Object.entries(def.fns ?? {});
+    for (const n of [...args, ...uses.map(([u]) => u)])
+        if (!plain.test(n) || reservedInRecur.includes(n) || n === name)
+            throw new Error(`recur ${name}: ${n} can't name an argument or a function here (${reservedInRecur.join(', ')} and ${name} are taken)`);
+    distinctNames(`recur ${name}`, [...args, ...uses.map(([u]) => u)]);
+    if (args.length > 4)
+        throw new Error(`recur ${name}: at most four further arguments`);
+    const named = (n) => new Term({ op: 'var', name: n });
+    const argsAt = (ts) => Object.fromEntries(args.map((a, i) => [a, ts[i]]));
+    const usesAt = (at) => Object.fromEntries(uses.map(([u, d]) => [u, fnTerm(at(u), d)]));
+    const envAt = (ts, at = u => u) => ({ ...argsAt(ts), ...usesAt(at) });
+    const zeroAt = (ts, at = u => u) => (typeof def.zero === 'function' ? def.zero(envAt(ts, at)) : def.zero);
+    // The recurrence over named variables (x, prev, the arguments; lemmas over x and fx; laws between over x, fx, y, fy),
+    // the functions it reads by their own names: what the runtimes and the Lean export are made from.
+    const own = args.map(named);
+    const zero = termOf(zeroAt(own)), next = termOf(def.next(named('x'), named('prev'), envAt(own)));
+    const only = (what, t, names, maps) => {
+        if (JSON.stringify(t).includes('"op":"all"') || JSON.stringify(t).includes('"op":"flag"'))
+            throw new Error(`recur ${name}: ${what} takes no quantifier`);
+        for (const n of namesIn(t))
+            if (!names.includes(n))
+                throw new Error(`recur ${name}: ${what} reads ${n}`);
+        for (const m of [...JSON.stringify(t).matchAll(/"op":"get","map":"([^"]+)"/g)].map(x => x[1]))
+            if (!maps.includes(m))
+                throw new Error(`recur ${name}: ${what} reads a function or a map it isn't given (${m})`);
+    };
+    only('zero', zero, args, uses.map(([u]) => u));
+    only('next', next, ['x', 'prev', ...args], uses.map(([u]) => u));
+    const stated = Object.entries(lemmas).map(([n, f]) => { const holds = f(named('x'), named('fx'), envAt(own)).c; only(`lemma "${n}"`, holds, ['x', 'fx', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
+    const pairs = Object.entries(between).map(([n, f]) => { const holds = f(named('x'), named('fx'), named('y'), named('fy'), envAt(own)).c; only(`law between "${n}"`, holds, ['x', 'fx', 'y', 'fy', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
+    const argKinds = Object.fromEntries(args.map(a => [a, nat]));
+    const failed = (what, v) => { if (!(v.proven && v.checked))
+        throw new Unproven(`${name}'s ${what}`, v); };
+    // The lemmas: x counting up from 0 and fx its value, each lemma a law of that machine.
+    let verdict = { proven: true, checked: true };
+    const proofs = {};
+    if (stated.length) {
+        // A start that reads a function is a param given as that start by a fact (a start reads the params alone).
+        const zeroReads = JSON.stringify(zero).includes('"op":"get"');
+        let r0 = rule(`${name}, by induction`).params({ ...argKinds, ...(zeroReads ? { fx0: nat } : {}) }).fns(def.fns ?? {}).inputs({});
+        if (zeroReads)
+            r0 = r0.facts((p) => ({ [`fx0 is ${name}(0)`]: p.fx0.eq(zeroAt(args.map(a => p[a]))) }));
+        const r = r0.state({ x: 0, fx: ((p) => (zeroReads ? p.fx0 : zeroAt(args.map(a => p[a])))) })
+            .step((env) => ({ x: env.x.plus(1), fx: def.next(env.x, env.fx, envAt(args.map(a => env[a]))) }));
+        const laws = Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a])))));
+        verdict = proveRule(r, laws);
+        failed('lemmas', verdict);
+        proofs.lemmas = { machine: r.machine, laws };
+    }
+    const js = recurJs(name, args, zero, next, uses);
+    const recurrence = { args, zero, next, lemmas: stated, between: pairs, uses: Object.fromEntries(uses.map(([u, d]) => [u, { arity: d.arity, ...(d.lean ? { lean: d.lean } : {}) }])), proofs };
+    // A law about every n keys (forall counts them by the callback's own parameters).
+    const keysOf = (n) => (f) => {
+        if (n === 0)
+            return f();
+        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d),
+            (a, b, c, d, e) => f(a, b, c, d, e), (a, b, c, d, e, g) => f(a, b, c, d, e, g)][n - 1];
+        return forall(by);
+    };
+    const facts = (withBetween) => (f, at = {}) => {
+        const env = (ts) => ({ ...argsAt(ts), ...Object.fromEntries(uses.map(([u, d]) => [u, at[u] ?? fnTerm(u, d)])) });
+        return {
+            [`${name}(0)`]: keysOf(args.length)((...as) => f(0, ...as).eq(typeof def.zero === 'function' ? def.zero(env(as)) : def.zero)),
+            [`${name}(x + 1)`]: keysOf(1 + args.length)((k, ...as) => f(k.plus(1), ...as).eq(def.next(k, f(k, ...as), env(as)))),
+            ...Object.fromEntries(Object.entries(lemmas).map(([n, l]) => [n, keysOf(1 + args.length)((k, ...as) => l(k, f(k, ...as), env(as)))])),
+            ...(withBetween ? Object.fromEntries(Object.entries(between).map(([n, l]) => [n, keysOf(2 + args.length)((k, j, ...as) => k.atMost(j).implies(l(k, f(k, ...as), j, f(j, ...as), env(as))))])) : {}),
+        };
+    };
+    const base = { arity: 1 + args.length, js, lean: `Recur.${name}`, recur: recurrence, ...(uses.length ? { uses: def.fns } : {}) };
+    // The laws between two points: y counting up from x and fy from fx, a value at x that meets the lemmas (as f(x)
+    // does: they are given of it, as facts of the params), each law a law of that machine beside the lemmas at y. What
+    // holds there for every such fx holds for f(x), and fy is f(y) by the recurrence; the machine reads no f at all.
+    if (pairs.length) {
+        const at = (env) => args.map(a => env[a]);
+        let r0 = rule(`${name}, between`).params({ ...argKinds, x: nat, fx: nat }).fns(def.fns ?? {}).inputs({});
+        if (stated.length)
+            r0 = r0.facts((p) => Object.fromEntries(Object.entries(lemmas).map(([n, l]) => [`${n} at x`, l(p.x, p.fx, envAt(at(p)))])));
+        const r = r0.state({ y: ((p) => p.x), fy: ((p) => p.fx) })
+            .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(at(env))) }));
+        const laws = [...Object.entries(lemmas).map(([n, l]) => r.law(`${n} at y`, (env) => l(env.y, env.fy, envAt(at(env))))),
+            ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env)))))];
+        const v = proveRule(r, laws);
+        failed('laws between two points', v);
+        proofs.between = { machine: r.machine, laws };
+        verdict = { proven: true, checked: verdict.checked && v.checked };
+    }
+    return { ...base, verdict, facts: facts(true) };
+};
+const distinctNames = (what, names) => { if (new Set(names).size !== names.length)
+    throw new Error(`${what}: a name given twice`); };
+// A recurrence as JavaScript: a function of its arguments, the functions it reads inlined (each as a function of its key,
+// as the runtimes call it).
+const recurJs = (name, args, zero, next, uses) => {
+    const fns = new Map(uses.map(([u], i) => [u, `$f${i}`]));
+    const js = (e) => {
+        switch (e.op) {
+            case 'var': return e.name;
+            case 'const': return String(e.value);
+            case 'add': return `(${js(e.a)} + ${js(e.b)})`;
+            case 'sub': return `Math.max(0, ${js(e.a)} - ${js(e.b)})`;
+            case 'mul': return `(${e.k} * ${js(e.a)})`;
+            case 'prod': return `(${js(e.a)} * ${js(e.b)})`;
+            case 'min': return `Math.min(${js(e.a)}, ${js(e.b)})`;
+            case 'max': return `Math.max(${js(e.a)}, ${js(e.b)})`;
+            case 'if': return `(${jc(e.c)} ? ${js(e.then)} : ${js(e.else)})`;
+            case 'get': return `${fns.get(e.map)}(${js(e.key)})`;
+        }
+    };
+    const jc = (c) => {
+        switch (c.op) {
+            case '<': return `(${js(c.a)} < ${js(c.b)})`;
+            case '<=': return `(${js(c.a)} <= ${js(c.b)})`;
+            case '=': return `(${js(c.a)} === ${js(c.b)})`;
+            case 'and': return c.xs.length ? `(${c.xs.map(jc).join(' && ')})` : 'true';
+            case 'or': return c.xs.length ? `(${c.xs.map(jc).join(' || ')})` : 'false';
+            case 'not': return `(!${jc(c.x)})`;
+            case 'flag':
+            case 'all': throw new Error('a recurrence takes no flag or quantifier');
+        }
+    };
+    const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); `).join('');
+    // The last value computed at each tuple of further arguments is kept, so reading f at x after f at a smaller x takes
+    // only the steps between (a rule that reads f at a count that grows costs one step a request).
+    return `(() => { ${inlined}const $memo = new Map(); return (x, ${args.map(a => `${a}, `).join('')}) => { const $k = ${args.length ? `[${args.join(', ')}].join()` : "''"}; let $at = $memo.get($k); if (!$at || $at[0] > x) $at = [0, ${js(zero)}]; let x0 = $at[0], prev = $at[1]; for (; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } if ($memo.size > 4096) $memo.clear(); $memo.set($k, [x, prev]); return prev; }; })()`;
+};
+// Functions with the functions they read, those first (named <function>.<use>), each with the terms its facts read them by.
+const flatFns = (defs) => defs.flatMap(([n, d]) => {
+    const uses = Object.entries(d.uses ?? {}).map(([u, ud]) => [`${n}.${u}`, ud]);
+    return [...flatFns(uses), [n, d, Object.fromEntries(uses.map(([un, ud]) => [un.slice(n.length + 1), fnTerm(un, ud)]))]];
+});
+const pairE = (a, b) => { const s = { op: 'add', a, b }; return { op: 'add', a: { op: 'prod', a: s, b: s }, b }; };
 const argsKey = (args) => args.slice(1).reduce(pairE, args[0]);
 // A function's JavaScript as one function of its key: its arguments unpaired (left-nested, as argsKey pairs them).
 const fnSource = (name, d) => {
@@ -842,7 +1251,7 @@ const fnSource = (name, d) => {
     }
     if (d.arity === 1)
         return src;
-    return `k => { const u = z => { const s = Math.floor(Math.sqrt(z)); return z - s * s < s ? [z - s * s, s] : [s, z - s * s - s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return (${src})(...a); }`;
+    return `(() => { const $fn = (${src}); return k => { const u = z => { let s = Math.floor(Math.sqrt(z)); while (s * s > z) s--; while ((s + 1) * (s + 1) <= z) s++; return [s - (z - s * s), z - s * s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return $fn(...a); }; })()`;
 };
 const fnTerm = (name, d) => (...args) => {
     if (args.length !== d.arity)
@@ -916,7 +1325,24 @@ export class Rule {
         }
         return this.with({ state: [...this.spec.state, ...entries], kinded: [...(this.spec.kinded ?? []), ...kinded] });
     }
-    maps(init) { return this.with({ maps: [...this.spec.maps, ...Object.entries(init)] }); }
+    // A map of naturals starts every cell at a natural; a map of a kind at the kind's value: `record({...}).from({...})`.
+    maps(init) {
+        const maps = [], cells = [];
+        for (const [n, x] of Object.entries(init)) {
+            if (typeof x === 'number') {
+                maps.push([n, x]);
+                continue;
+            }
+            const { kind, init: start } = x;
+            if (typeof start === 'function')
+                throw new Error(`map ${n}: every cell starts at one value (not a term over the params)`);
+            const enc = kind.encode(n, start);
+            cells.push([n, kind]);
+            for (const part of kind.vars(n))
+                maps.push([part, enc[part]]);
+        }
+        return this.with({ maps: [...this.spec.maps, ...maps], cells: [...(this.spec.cells ?? []), ...cells] });
+    }
     // Integers (Int), each starting at an integer or at one over the params; kept as two naturals, <name> and <name>$neg.
     ints(init) {
         return this.state(Object.fromEntries(Object.entries(init).map(([n, x]) => [n, int.from(x)])));
@@ -930,6 +1356,13 @@ export class Rule {
     lists(...names) {
         return this.with({ maps: [...this.spec.maps, ...names.map(n => [n, 0])], state: [...this.spec.state, ...names.map(n => [`${n}_len`, 0])], lists: [...(this.spec.lists ?? []), ...names] });
     }
+    // Lists whose items are values of a kind, each empty at the start: one list per variable of the kind, of one length
+    // <name>_len (ItemsRef).
+    items(kinds) {
+        const entries = Object.entries(kinds);
+        return this.with({ maps: [...this.spec.maps, ...entries.flatMap(([n, k]) => k.vars(n).map(part => [part, 0]))],
+            state: [...this.spec.state, ...entries.map(([n]) => [`${n}_len`, 0])], items: [...(this.spec.items ?? []), ...entries] });
+    }
     // Functions defined outside the rule (fn, divBy, modBy), read like params that take arguments: f(x).
     fns(defs) {
         return this.with({ fns: [...(this.spec.fns ?? []), ...Object.entries(defs)] });
@@ -979,6 +1412,22 @@ export class Rule {
         const [k1, more] = keysFor(out), holds = out.forall(v(k1), ...more.map(v)).c;
         return more.length ? { name, forall: k1, keys: more, holds } : { name, forall: k1, holds: prenex(holds, `law ${name}`, k1) ?? holds };
     }
+    // What the kinds keep true of the state and of the maps and lists of a kind (Kind.invariant: a flag 0 or 1, a choice or
+    // a case in range, a presence bit 0 or 1), as laws: proveRule, proveSteps and proveLeadsTo prove them beside the laws
+    // they are given, so a law may lean on "the hold is idle, holding or released" without stating it; give them to
+    // toLean (or the kernel) with the rest.
+    kindLaws() {
+        const out = [];
+        const of = (env, n) => env[n];
+        for (const [n, k] of this.spec.kinded ?? [])
+            if (k.invariant(k.value(n)).length)
+                out.push(this.law(`${n} is a value of its kind`, env => all(...k.invariant(of(env, n)))));
+        for (const [n, k] of [...this.spec.cells ?? [], ...this.spec.items ?? []])
+            if (k.invariant(k.value(n)).length) {
+                out.push(this.law(`every ${n} cell is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
+            }
+        return out;
+    }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
     // the request, state, maps, flags, sums, queries) to the state, maps and sums after it. `when` narrows the requests.
     //   counter.stepLaw('never goes back', ({used}, after) => used.atMost(after.used))
@@ -1073,6 +1522,7 @@ export class Rule {
             after[n] = new MapRef(`${n}'`, init);
         for (const n of this.spec.lists ?? [])
             after[n] = new ListRef(`${n}'`, v(`${n}_len'`));
+        this.composites(after, part => `${part}'`, n => v(`${n}_len'`));
         for (const [n, k] of this.spec.kinded ?? []) {
             for (const part of k.vars(n))
                 delete after[part];
@@ -1101,6 +1551,7 @@ export class Rule {
                 out[n] = new MapRef(n, init);
             for (const n of this.spec.lists ?? [])
                 out[n] = new ListRef(n, v(`${n}_len`));
+            this.composites(out, part => part, n => v(`${n}_len`));
             for (const [n] of this.spec.sums)
                 out[n] = v(n);
             for (const [n, k] of this.spec.kinded ?? []) {
@@ -1121,12 +1572,27 @@ export class Rule {
                 }
         return out;
     }
+    // Maps and lists of a kind in place of their parts' maps (and a list's length), each part's map named by `at`.
+    composites(out, at, len) {
+        const init = new Map(this.spec.maps);
+        for (const [n, k] of this.spec.cells ?? []) {
+            for (const part of k.vars(n))
+                delete out[part];
+            out[n] = new CellsRef(n, k, part => new MapRef(at(part), init.get(part)));
+        }
+        for (const [n, k] of this.spec.items ?? []) {
+            for (const part of k.vars(n))
+                delete out[part];
+            out[n] = new ItemsRef(n, k, len(n), part => new ListRef(at(part), len(n)));
+        }
+    }
     // Every name the rule declares is declared once (a flag named again replaces the earlier one, so flags are checked as
     // they are defined): an input and a state variable sharing a name would hand the callbacks only one of them.
     names() {
         const s = this.spec;
         return [...s.params.map(([n]) => [n, 'a param']), ...(s.fns ?? []).map(([n]) => [n, 'a function']), ...s.inputs.map(([n]) => [n, 'an input']), ...(s.carried ?? []).map(n => [n, 'a carried map']),
             ...s.state.map(([n]) => [n, 'a state variable']), ...s.maps.map(([n]) => [n, 'a map']), ...s.sums.map(([n]) => [n, 'a sum']), ...s.queries.map(([n]) => [n, 'a query']),
+            ...[...(s.cells ?? []), ...(s.items ?? [])].filter(([n, k]) => !k.vars(n).includes(n)).map(([n]) => [n, 'a map of a kind']),
         ];
     }
     whatIs(n) { return this.names().find(([m]) => m === n)?.[1] ?? 'something else'; }
@@ -1173,6 +1639,7 @@ export class Rule {
             delete updates[n];
             Object.assign(updates, k.store(n, u));
         }
+        expandParts(updates);
         const state = {}, maps = {};
         for (const [n, u] of Object.entries(updates)) {
             if (u === undefined)
@@ -1189,9 +1656,11 @@ export class Rule {
         const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => hoist.cond(f(env).c))];
         placed();
         // Functions, and their facts: each function's own (named after it), then the rule's.
-        const fns = Object.fromEntries((s.fns ?? []).map(([n, d]) => [n, { js: fnSource(n, d), ...(d.lean ? { lean: d.lean } : {}) }]));
+        // The functions a function reads come first, each named <function>.<use>.
+        const flat = flatFns(s.fns ?? []);
+        const fns = Object.fromEntries(flat.map(([n, d]) => [n, { js: fnSource(n, d), ...(d.lean ? { lean: d.lean } : {}), ...(d.recur ? { recur: d.recur } : {}) }]));
         const facts = [
-            ...(s.fns ?? []).flatMap(([n, d]) => Object.entries(d.facts?.(fnTerm(n, d)) ?? {}).map(([name, f]) => this.lawOf(`${n}: ${name}`, f))),
+            ...flat.flatMap(([n, d, uses]) => Object.entries(d.facts?.(fnTerm(n, d), uses) ?? {}).map(([name, f]) => this.lawOf(`${n}: ${name}`, f))),
             ...(s.facts ?? []).flatMap(f => Object.entries(f(pEnv)).map(([name, out]) => this.lawOf(name, out))),
         ];
         const m = {
@@ -1311,7 +1780,7 @@ export class Rule {
         }
         // The updates: every state variable as its value is written (a kinded one through its kind's `store`, as the
         // machine is built) or kept, and each map write.
-        const updates = inScope(sc, () => s.step?.(this.env()) ?? {});
+        const updates = inScope(sc, () => expandParts(s.step?.(this.env()) ?? {}));
         const written = { ...updates };
         inScope(sc, () => { for (const [n, k] of s.kinded ?? [])
             if (updates[n] !== undefined) {
@@ -1385,8 +1854,8 @@ export class Rule {
                 const got = this.decode(ours);
                 for (const [field, want] of Object.entries(theirs)) {
                     checked++;
-                    if (got[field] !== want)
-                        return { checked, failure: `${s.name}, params ${JSON.stringify(params)}, after ${JSON.stringify(request)}: ${field} is ${got[field]} here, ${want} in the code it describes` };
+                    if (!sameRaw(got[field], want))
+                        return { checked, failure: `${s.name}, params ${JSON.stringify(params)}, after ${JSON.stringify(request)}: ${field} is ${shown(got[field])} here, ${shown(want)} in the code it describes` };
                 }
             }
         }
@@ -1421,6 +1890,14 @@ export class Rule {
                 delete out[part];
             out[n] = k.decode(n, st.scalars);
         }
+        // A map of a kind: the keys any of its parts holds a cell at, each with its value; a list of a kind: its items.
+        const cell = (n, k, key) => k.decode(n, Object.fromEntries(k.vars(n).map(part => [part, st.maps[part]?.get(key) ?? st.defaults?.[part] ?? new Map(this.spec.maps).get(part)])));
+        for (const [n, k] of this.spec.cells ?? []) {
+            const keys = [...new Set(k.vars(n).flatMap(part => [...(st.maps[part]?.keys() ?? [])]))].sort((a, b) => a - b);
+            out[n] = Object.fromEntries(keys.map(key => [key, cell(n, k, key)]));
+        }
+        for (const [n, k] of this.spec.items ?? [])
+            out[n] = Array.from({ length: st.scalars[`${n}_len`] }, (_, i) => cell(n, k, i));
         return out;
     }
     // The prune order's variable, if the history is pruned (a runtime must send it nondecreasing).
@@ -1430,10 +1907,20 @@ export class Rule {
         return loadJs(this.machine);
     }
 }
+// A step's writes to maps and lists of a kind, as the writes to their parts' maps.
+const expandParts = (updates) => {
+    for (const [n, u] of Object.entries(updates))
+        if (isPartsWrite(u)) {
+            delete updates[n];
+            Object.assign(updates, u.parts);
+        }
+    return updates;
+};
 const encode = (kinds, values) => Object.assign({}, ...kinds.map(([n, k]) => k.encode(n, values[n])));
 export const rule = (name) => new Rule({ name, params: [], inputs: [], state: [], maps: [], flags: [], pre: [], assume: [], sums: [], queries: [] });
 // The kind a result field is kept in.
-const kindOf = (t) => (t instanceof Cond ? bool : t instanceof Int ? int : t instanceof Decimal ? decimal(t.places) : t instanceof Choice ? oneOf(...t.values) : t instanceof Str ? str({ like: t.patterns }) : nat);
+const kindOf = (t) => (t instanceof Cond ? bool : t instanceof Int ? int : t instanceof Decimal ? decimal(t.places) : t instanceof Choice ? oneOf(...t.values) : t instanceof Str ? str({ like: t.patterns })
+    : t instanceof Variant ? t.kind : t instanceof Maybe ? maybe(kindOf(t.inner)) : isRecord(t) ? record(Object.fromEntries(Object.entries(t).map(([f, x]) => [f, kindOf(x)]))) : nat);
 export class Fun {
     r;
     out;
@@ -1475,8 +1962,8 @@ export class Fun {
             const ours = this.run(values, params), theirs = reference(values, params);
             for (const [field, want] of Object.entries(theirs)) {
                 checked++;
-                if (ours[field] !== want)
-                    return { checked, failure: `${this.name} at ${JSON.stringify(values)}: ${field} is ${String(ours[field])} here, ${String(want)} in the code it describes` };
+                if (!sameRaw(ours[field], want))
+                    return { checked, failure: `${this.name} at ${JSON.stringify(values)}: ${field} is ${shown(ours[field])} here, ${shown(want)} in the code it describes` };
             }
         }
         return { checked };
@@ -1557,6 +2044,15 @@ export class LoopRule {
     randomInput(rand, bound) { return Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound))); }
 }
 export const loop = (name) => new LoopRule({ name, params: [], inputs: [], state: [], pre: [], assume: [] });
+// A verdict that isn't a checked proof, as the error a lemma, a guard or a gate is refused with (the verdict on `.verdict`).
+export class Unproven extends Error {
+    verdict;
+    constructor(what, verdict) {
+        const found = [verdict.goal && `goal ${verdict.goal}`, verdict.stuck, verdict.witness && `a counterexample: ${JSON.stringify(verdict.witness)}`, verdict.why].filter(Boolean).join('; ');
+        super(`${what}: ${verdict.proven ? 'proven, but the kernel did not check the proof' : `not proven${found ? ` (${found})` : ''}`}`);
+        this.verdict = verdict;
+    }
+}
 const goalsVerdict = (goals) => {
     const trees = {};
     for (const g of goals) {
@@ -1567,16 +2063,18 @@ const goalsVerdict = (goals) => {
     }
     return { proven: true, checked: goals.every(g => check(g, trees[g.name])), trees };
 };
+// The kinds' laws first, those the caller didn't pass already (by name).
+const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.name === k.name)), ...laws];
 export function proveRule(r, laws) {
-    const out = proveLaws(r.machine, laws);
+    const out = proveLaws(r.machine, withKinds(r, laws));
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveSteps(r, laws, stepLaws) {
-    const out = proveStepLaws(r.machine, laws, stepLaws);
+    const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveLeadsTo(r, laws, l) {
-    const out = proveLiveness(r.machine, laws, l);
+    const out = proveLiveness(r.machine, withKinds(r, laws), l);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export const proveDecision = (d) => goalsVerdict([d.goal]);