gdp-wired 0.8.0 → 0.10.0

package/dist/core/dsl.js

@@ -15,9 +15,9 @@
 //
 // A step returns its updates as one object: every right-hand side reads the state before the step, as the kernel and
 // both runtimes do.
-import { carriedView, compileFunction, evalC, interpret, loadJs, numbersOf } from "./machine.js";
+import { carriedView, compileFunction, evalC, evalE, interpret, loadJs, numbersOf } from "./machine.js";
 import { allowed, keysOf, requestEnv, watch } from "./watch.js";
-import { check, loopObligations } from "../kernel/kernel.js";
+import { check, foldObligations, loopObligations } from "../kernel/kernel.js";
 import { factsFor, grow, proveLaws, proveLiveness, proveStepLaws } from "../kernel/prove.js";
 // --- terms and conditions -------------------------------------------------------------------------------------------
 const naturalConst = (v) => {
@@ -158,6 +158,10 @@ const named = (at, n) => (typeof at === 'string' ? at + n : at(n));
 const primed = (n) => `${n}'`;
 export class Kind {
     value(name, at = '') { return this.build(name, part => v(named(at, part))); }
+    // What every value a step writes keeps true of its variables (a flag is 0 or 1, a choice or a case in range, a
+    // presence bit 0 or 1), unlike a bound such as upTo's, which a step may pass: the laws a rule's state and cells of the
+    // kind are proven to keep (Rule.kindLaws).
+    invariant(_value) { return []; }
     // A runtime value of the kind (what encode takes), for comparing a rule with the code it describes (compare).
     sample(_rand, _bound) { throw new Error('this kind draws no runtime values'); }
     // A state variable of this kind starting at a runtime value, or at a value over the params: `.state({open: bool.from(true)})`.
@@ -321,6 +325,7 @@ class BoolKind extends Kind {
     vars(name) { return [name]; }
     assume(name) { return [v(name).atMost(1)]; }
     build(name, get) { return new Bool(get(name)); }
+    invariant(b) { return [b.n.atMost(1)]; }
     store(name, value) { return { [name]: typeof value === 'boolean' ? (value ? 1 : 0) : count(value) }; }
     decode(name, vars) { return vars[name] === 1; }
     empty() { return false; }
@@ -370,6 +375,7 @@ class OneOfKind extends Kind {
     vars(name) { return [name]; }
     assume(name) { return [v(name).lt(this.values.length)]; }
     build(name, get) { return new Choice(get(name), this.values); }
+    invariant(c) { return [c.n.lt(this.values.length)]; }
     store(name, value) { return { [name]: value instanceof Choice ? value.n : this.encode(name, value)[name] }; }
     decode(name, vars) { return this.values[vars[name]]; }
     empty() { return this.values[0]; }
@@ -414,6 +420,7 @@ class MaybeKind extends Kind {
     vars(name) { return [this.has(name), ...this.of.vars(name)]; }
     assume(name) { return [v(this.has(name)).atMost(1), ...this.of.assume(name)]; }
     build(name, get) { return new Maybe(get(this.has(name)), this.of.build(name, get)); }
+    invariant(m) { return [m.present.atMost(1), ...this.of.invariant(m.inner)]; }
     // null for none, a Maybe as it is, any other value as some.
     store(name, value) {
         if (value === null || value === undefined)
@@ -435,6 +442,8 @@ class MaybeKind extends Kind {
     sample(rand, bound) { return rand(4) === 0 ? null : this.of.sample(rand, bound); }
 }
 export const maybe = (of) => new MaybeKind(of);
+// A value present where c holds and missing elsewhere (a function's result that may be missing, say).
+export const optional = (c, value) => new Maybe(count(c), value);
 const fieldName = (name, f) => `${name}.${f}`;
 const plainFields = (what, names) => { for (const f of names)
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
@@ -473,6 +482,7 @@ class RecordKind extends Kind {
     vars(name) { composite(name); return this.each((f, k) => k.vars(fieldName(name, f))).flat(); }
     assume(name) { return this.each((f, k) => k.assume(fieldName(name, f))).flat(); }
     build(name, get) { return Object.fromEntries(this.each((f, k) => [f, k.build(fieldName(name, f), get)])); }
+    invariant(r) { return this.each((f, k) => k.invariant(r[f])).flat(); }
     store(name, value) {
         const o = value;
         if (o === null || typeof o !== 'object')
@@ -516,19 +526,20 @@ export class Variant {
 }
 export class VariantKind extends Kind {
     cases;
+    tagKey;
     names;
-    tagKey = 'tag';
-    constructor(cases) {
+    constructor(cases, tagKey) {
         super();
         this.cases = cases;
+        this.tagKey = tagKey;
         this.names = Object.keys(cases);
         if (this.names.length === 0)
             throw new Error('a variant has a case');
         plainFields('variant', this.names);
         for (const k of this.names) {
             plainFields(`variant case ${k}`, Object.keys(cases[k]));
-            if ('tag' in cases[k])
-                throw new Error(`variant case ${k}: tag names the case, not a field`);
+            if (tagKey in cases[k])
+                throw new Error(`variant case ${k}: ${tagKey} names the case, not a field`);
         }
     }
     index(k) {
@@ -547,6 +558,7 @@ export class VariantKind extends Kind {
     }
     // The value of a case with these fields (terms, values or runtime values), to compare, match or pass to `when`:
     //   when(held, At.make({tag: 'holding', amount, since: now}), at)
+    invariant(x) { return [x.tag.lt(this.names.length), ...this.names.filter(k => this.filled(k)).flatMap(k => this.payload(k).invariant(x.cases[k]))]; }
     make(write) {
         const parts = this.store('$', write);
         return this.build('$', part => { const t = parts[part]; return typeof t === 'number' ? lit(t) : t; });
@@ -586,7 +598,12 @@ export class VariantKind extends Kind {
     }
     sample(rand, bound) { const k = this.names[rand(this.names.length)]; return { [this.tagKey]: k, ...(this.filled(k) ? this.payload(k).sample(rand, bound) : {}) }; }
 }
-export const variant = (cases) => new VariantKind(cases);
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function variant(cases, opts = {}) {
+    if (opts.tag !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(opts.tag))
+        throw new Error(`variant: ${opts.tag} is not a plain key`);
+    return new VariantKind(cases, opts.tag ?? 'tag');
+}
 // A string, encoded as its interned name, its length and one bit per pattern the kind declares (`like`, Cedar's glob:
 // `*` any run of characters, `\*` a star): all computed from the string itself when the input is encoded, so the bits
 // are the string's, not an answer someone supplies. Names come from one table per process, the empty string 0; a law
@@ -850,6 +867,89 @@ export class CellsRef {
         return { parts: Object.fromEntries(this.kind.vars(this.name).map(part => [part, this.map(part).each(k => partsOf(this.kind, this.name, f(k))[part])])) };
     }
 }
+export class CarriedList {
+    name;
+    kind;
+    len;
+    folds;
+    map;
+    lemmas;
+    fold;
+    constructor(name, kind, len, folds, map, lemmas = {}) {
+        this.name = name;
+        this.kind = kind;
+        this.len = len;
+        this.folds = folds;
+        this.map = map;
+        this.lemmas = lemmas;
+        this.fold = Object.fromEntries(Object.keys(folds).map(f => [f, map(`${name}$${f}`).at(len)]));
+    }
+    at(i) { return this.kind.build(this.name, part => this.map(part).at(i)); }
+    // The running value of a fold after the first i items.
+    after(fold, i) { return this.map(`${this.name}$${fold}`).at(i); }
+    every(f) { return everyKey(k => k.lt(this.len).implies(f(this.at(k), k))); }
+    some(f) { return this.every((x, i) => f(x, i).not()).not(); }
+    has(x) { return this.some(y => same(y, x)); }
+    // Each item's `by` below the next one's (so no two alike).
+    increasing(by) { return everyKey(k => k.plus(1).lt(this.len).implies(by(this.at(k)).lt(by(this.at(k.plus(1)))))); }
+    // What every request is assumed to meet: each fold's start, and at every key one condition (the item's own laws and
+    // each fold's step below the length, each lemma up to it), so the prover closes one quantifier, not one per part.
+    equations() {
+        const folds = Object.entries(this.folds), lemmas = Object.values(this.lemmas);
+        const at = (k) => {
+            const x = this.at(k), steps = folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(k.plus(1)).eq(d.step(this.map(`${this.name}$${f}`).at(k), x)));
+            const below = [...this.kind.invariant(x), ...steps];
+            return all(...(below.length ? [k.lt(this.len).implies(all(...below))] : []), ...(lemmas.length ? [k.atMost(this.len).implies(all(...lemmas.map(l => l(this.running(k), k))))] : []));
+        };
+        const any = this.kind.invariant(this.kind.value(this.name)).length + folds.length + lemmas.length > 0;
+        return [...folds.map(([f, d]) => this.map(`${this.name}$${f}`).at(0).eq(d.from)), ...(any ? [everyKey(at)] : [])];
+    }
+    running(k) { return Object.fromEntries(Object.keys(this.folds).map(f => [f, this.after(f, k)])); }
+    // The lemmas, proven: the folds as a machine counting i up from 0 over items that are functions of i known only by
+    // the kind's own laws, each lemma a law of it (so it holds after every prefix of every list).
+    prove() {
+        if (!Object.keys(this.lemmas).length)
+            return { proven: true, checked: true };
+        const parts = this.kind.vars(this.name), fname = (p) => `item$${p.replaceAll('.', '$')}`;
+        const item = (i) => this.kind.build(this.name, p => new Term({ op: 'get', map: fname(p), key: i.e }));
+        // Every item is a value of the kind (its own laws, as a fact of the first part's function).
+        const kindFact = this.kind.invariant(this.kind.value(this.name)).length ? { 'every item is a value of its kind': forall(k => all(...this.kind.invariant(item(k)))) } : {};
+        const fns = Object.fromEntries(parts.map((p, j) => [fname(p), fn(1, 'x => 0', j === 0 ? { facts: () => kindFact } : {})]));
+        const folds = Object.entries(this.folds);
+        const r = rule(`${this.name}'s folds, by induction`).fns(fns).inputs({}).state({ i: 0, ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.from])) })
+            .step((env) => ({ i: env.i.plus(1), ...Object.fromEntries(folds.map(([f, d]) => [`acc$${f}`, d.step(env[`acc$${f}`], item(env.i))])) }));
+        const accs = (env) => Object.fromEntries(folds.map(([f]) => [f, env[`acc$${f}`]]));
+        return proveRule(r, Object.entries(this.lemmas).map(([n, l]) => r.law(n, (env) => l(accs(env), env.i))));
+    }
+    // Every carried map it is kept in: the items' parts, then each fold's.
+    get maps() { return [...this.kind.vars(this.name), ...Object.keys(this.folds).map(f => `${this.name}$${f}`)]; }
+    // A request's list as those maps and its length: each fold computed by its step, as the builders compute it.
+    encode(raw) {
+        if (!Array.isArray(raw))
+            throw new RangeError(`${this.name} must be a list, not ${shown(raw)}`);
+        const items = raw.map(x => this.kind.encode(this.name, x));
+        const maps = Object.fromEntries(this.maps.map(m => [m, new Map()]));
+        items.forEach((enc, i) => { for (const [part, x] of Object.entries(enc))
+            if (x !== 0)
+                maps[part].set(i, x); });
+        for (const [f, d] of Object.entries(this.folds)) {
+            const acc = maps[`${this.name}$${f}`];
+            let value = d.from;
+            if (value !== 0)
+                acc.set(0, value);
+            items.forEach((enc, i) => {
+                const item = this.kind.build(this.name, part => new Term({ op: 'const', value: enc[part] }, enc[part]));
+                const next = valOf(d.step(new Term({ op: 'const', value }, value), item));
+                if (next === undefined || !Number.isSafeInteger(next) || next < 0)
+                    throw new RangeError(`${this.name}'s fold ${f} reads more than its items`);
+                value = next;
+                if (value !== 0)
+                    acc.set(i + 1, value);
+            });
+        }
+        return { maps, len: items.length };
+    }
+}
 export class ItemsRef {
     name;
     kind;
@@ -1084,7 +1184,7 @@ export const modBy = (c) => {
             [`r(x + ${c}) = r(x)`]: forall(x => f(x.plus(c)).eq(f(x))),
         }) });
 };
-const reservedInRecur = ['x', 'fx', 'y', 'fy', 'prev', 'x0'];
+const reservedInRecur = ['x', 'fx', 'y', 'fy', 'prev', 'x0', 'fx0'];
 export const recur = (name, def, lemmas = {}, between = {}) => {
     const plain = /^[A-Za-z][A-Za-z0-9_]*$/;
     if (!plain.test(name))
@@ -1094,15 +1194,13 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         if (!plain.test(n) || reservedInRecur.includes(n) || n === name)
             throw new Error(`recur ${name}: ${n} can't name an argument or a function here (${reservedInRecur.join(', ')} and ${name} are taken)`);
     distinctNames(`recur ${name}`, [...args, ...uses.map(([u]) => u)]);
-    if (args.length > 2 && Object.keys(between).length)
-        throw new Error(`recur ${name}: a law between two points takes at most two further arguments`);
-    if (args.length > 3)
-        throw new Error(`recur ${name}: at most three further arguments`);
+    if (args.length > 4)
+        throw new Error(`recur ${name}: at most four further arguments`);
     const named = (n) => new Term({ op: 'var', name: n });
     const argsAt = (ts) => Object.fromEntries(args.map((a, i) => [a, ts[i]]));
     const usesAt = (at) => Object.fromEntries(uses.map(([u, d]) => [u, fnTerm(at(u), d)]));
     const envAt = (ts, at = u => u) => ({ ...argsAt(ts), ...usesAt(at) });
-    const zeroAt = (ts) => (typeof def.zero === 'function' ? def.zero(argsAt(ts)) : def.zero);
+    const zeroAt = (ts, at = u => u) => (typeof def.zero === 'function' ? def.zero(envAt(ts, at)) : def.zero);
     // The recurrence over named variables (x, prev, the arguments; lemmas over x and fx; laws between over x, fx, y, fy),
     // the functions it reads by their own names: what the runtimes and the Lean export are made from.
     const own = args.map(named);
@@ -1117,7 +1215,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
             if (!maps.includes(m))
                 throw new Error(`recur ${name}: ${what} reads a function or a map it isn't given (${m})`);
     };
-    only('zero', zero, args, []);
+    only('zero', zero, args, uses.map(([u]) => u));
     only('next', next, ['x', 'prev', ...args], uses.map(([u]) => u));
     const stated = Object.entries(lemmas).map(([n, f]) => { const holds = f(named('x'), named('fx'), envAt(own)).c; only(`lemma "${n}"`, holds, ['x', 'fx', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
     const pairs = Object.entries(between).map(([n, f]) => { const holds = f(named('x'), named('fx'), named('y'), named('fy'), envAt(own)).c; only(`law between "${n}"`, holds, ['x', 'fx', 'y', 'fy', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
@@ -1126,44 +1224,55 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         throw new Unproven(`${name}'s ${what}`, v); };
     // The lemmas: x counting up from 0 and fx its value, each lemma a law of that machine.
     let verdict = { proven: true, checked: true };
+    const proofs = {};
     if (stated.length) {
-        const r = rule(`${name}, by induction`).params(argKinds).fns(def.fns ?? {}).inputs({}).state({ x: 0, fx: ((p) => zeroAt(args.map(a => p[a]))) })
+        // A start that reads a function is a param given as that start by a fact (a start reads the params alone).
+        const zeroReads = JSON.stringify(zero).includes('"op":"get"');
+        let r0 = rule(`${name}, by induction`).params({ ...argKinds, ...(zeroReads ? { fx0: nat } : {}) }).fns(def.fns ?? {}).inputs({});
+        if (zeroReads)
+            r0 = r0.facts((p) => ({ [`fx0 is ${name}(0)`]: p.fx0.eq(zeroAt(args.map(a => p[a]))) }));
+        const r = r0.state({ x: 0, fx: ((p) => (zeroReads ? p.fx0 : zeroAt(args.map(a => p[a])))) })
             .step((env) => ({ x: env.x.plus(1), fx: def.next(env.x, env.fx, envAt(args.map(a => env[a]))) }));
-        verdict = proveRule(r, Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a]))))));
+        const laws = Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a])))));
+        verdict = proveRule(r, laws);
         failed('lemmas', verdict);
+        proofs.lemmas = { machine: r.machine, laws };
     }
     const js = recurJs(name, args, zero, next, uses);
-    const recurrence = { args, zero, next, lemmas: stated, between: pairs, uses: Object.fromEntries(uses.map(([u, d]) => [u, { arity: d.arity, ...(d.lean ? { lean: d.lean } : {}) }])) };
+    const recurrence = { args, zero, next, lemmas: stated, between: pairs, uses: Object.fromEntries(uses.map(([u, d]) => [u, { arity: d.arity, ...(d.lean ? { lean: d.lean } : {}) }])), proofs };
     // A law about every n keys (forall counts them by the callback's own parameters).
     const keysOf = (n) => (f) => {
         if (n === 0)
             return f();
-        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d)][n - 1];
+        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d),
+            (a, b, c, d, e) => f(a, b, c, d, e), (a, b, c, d, e, g) => f(a, b, c, d, e, g)][n - 1];
         return forall(by);
     };
     const facts = (withBetween) => (f, at = {}) => {
         const env = (ts) => ({ ...argsAt(ts), ...Object.fromEntries(uses.map(([u, d]) => [u, at[u] ?? fnTerm(u, d)])) });
         return {
-            [`${name}(0)`]: keysOf(args.length)((...as) => f(0, ...as).eq(zeroAt(as))),
+            [`${name}(0)`]: keysOf(args.length)((...as) => f(0, ...as).eq(typeof def.zero === 'function' ? def.zero(env(as)) : def.zero)),
             [`${name}(x + 1)`]: keysOf(1 + args.length)((k, ...as) => f(k.plus(1), ...as).eq(def.next(k, f(k, ...as), env(as)))),
             ...Object.fromEntries(Object.entries(lemmas).map(([n, l]) => [n, keysOf(1 + args.length)((k, ...as) => l(k, f(k, ...as), env(as)))])),
             ...(withBetween ? Object.fromEntries(Object.entries(between).map(([n, l]) => [n, keysOf(2 + args.length)((k, j, ...as) => k.atMost(j).implies(l(k, f(k, ...as), j, f(j, ...as), env(as))))])) : {}),
         };
     };
     const base = { arity: 1 + args.length, js, lean: `Recur.${name}`, recur: recurrence, ...(uses.length ? { uses: def.fns } : {}) };
-    // The laws between two points: y counting up from x, fy from f(x) (a param, given as f(x) by a fact), each law a law
-    // of that machine beside "fy is f(y)", which lets the lemmas speak at y.
+    // The laws between two points: y counting up from x and fy from fx, a value at x that meets the lemmas (as f(x)
+    // does: they are given of it, as facts of the params), each law a law of that machine beside the lemmas at y. What
+    // holds there for every such fx holds for f(x), and fy is f(y) by the recurrence; the machine reads no f at all.
     if (pairs.length) {
-        const self = { ...base, facts: facts(false) };
-        const r = rule(`${name}, between`).params({ ...argKinds, x: nat, fx: nat }).fns({ [name]: self }).inputs({})
-            .facts(((p) => ({ [`fx is ${name}(x)`]: p.fx.eq(p[name](p.x, ...args.map(a => p[a]))) })))
-            .state({ y: ((p) => p.x), fy: ((p) => p.fx) })
-            .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(args.map(a => env[a]), u => `${name}.${u}`)) }));
         const at = (env) => args.map(a => env[a]);
-        const laws = [r.law(`fy is ${name}(y)`, (env) => env.fy.eq(env[name](env.y, ...at(env)))),
-            ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env), u => `${name}.${u}`))))];
+        let r0 = rule(`${name}, between`).params({ ...argKinds, x: nat, fx: nat }).fns(def.fns ?? {}).inputs({});
+        if (stated.length)
+            r0 = r0.facts((p) => Object.fromEntries(Object.entries(lemmas).map(([n, l]) => [`${n} at x`, l(p.x, p.fx, envAt(at(p)))])));
+        const r = r0.state({ y: ((p) => p.x), fy: ((p) => p.fx) })
+            .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(at(env))) }));
+        const laws = [...Object.entries(lemmas).map(([n, l]) => r.law(`${n} at y`, (env) => l(env.y, env.fy, envAt(at(env))))),
+            ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env)))))];
         const v = proveRule(r, laws);
         failed('laws between two points', v);
+        proofs.between = { machine: r.machine, laws };
         verdict = { proven: true, checked: verdict.checked && v.checked };
     }
     return { ...base, verdict, facts: facts(true) };
@@ -1201,7 +1310,9 @@ const recurJs = (name, args, zero, next, uses) => {
         }
     };
     const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); `).join('');
-    return `(x, ${args.map(a => `${a}, `).join('')}) => { ${inlined}let prev = ${js(zero)}; for (let x0 = 0; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } return prev; }`;
+    // The last value computed at each tuple of further arguments is kept, so reading f at x after f at a smaller x takes
+    // only the steps between (a rule that reads f at a count that grows costs one step a request).
+    return `(() => { ${inlined}const $memo = new Map(); return (x, ${args.map(a => `${a}, `).join('')}) => { const $k = ${args.length ? `[${args.join(', ')}].join()` : "''"}; let $at = $memo.get($k); if (!$at || $at[0] > x) $at = [0, ${js(zero)}]; let x0 = $at[0], prev = $at[1]; for (; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } if ($memo.size > 4096) $memo.clear(); $memo.set($k, [x, prev]); return prev; }; })()`;
 };
 // Functions with the functions they read, those first (named <function>.<use>), each with the terms its facts read them by.
 const flatFns = (defs) => defs.flatMap(([n, d]) => {
@@ -1223,7 +1334,7 @@ const fnSource = (name, d) => {
     }
     if (d.arity === 1)
         return src;
-    return `k => { const u = z => { let s = Math.floor(Math.sqrt(z)); while (s * s > z) s--; while ((s + 1) * (s + 1) <= z) s++; return [s - (z - s * s), z - s * s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return (${src})(...a); }`;
+    return `(() => { const $fn = (${src}); return k => { const u = z => { let s = Math.floor(Math.sqrt(z)); while (s * s > z) s--; while ((s + 1) * (s + 1) <= z) s++; return [s - (z - s * s), z - s * s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return $fn(...a); }; })()`;
 };
 const fnTerm = (name, d) => (...args) => {
     if (args.length !== d.arity)
@@ -1343,6 +1454,27 @@ export class Rule {
     facts(f) { return this.with({ facts: [...(this.spec.facts ?? []), f] }); }
     // Maps each request carries whole (a set of names, say: cells 0 or 1), every cell past them 0; read like any map.
     carries(...names) { return this.with({ carried: [...(this.spec.carried ?? []), ...names] }); }
+    // A list of values of a kind each request carries, with folds over it and lemmas about the folds (CarriedList):
+    //   .carriesList('Lines', record({amount: nat}), {total: {from: 0, step: (acc, line) => acc.plus(line.amount)}})
+    carriesList(name, of, folds = {}, lemmas = {}) {
+        const entries = [[name, of, folds, lemmas]];
+        for (const [n, , fs] of entries)
+            for (const f of Object.keys(fs))
+                if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                    throw new Error(`${n}: ${f} is not a plain fold name`);
+        // The folds' lemmas, proven now (a lemma that isn't throws, with the verdict).
+        for (const [n, k, fs, ls] of entries) {
+            const v2 = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls).prove();
+            if (!(v2.proven && v2.checked))
+                throw new Unproven(`${n}'s fold lemmas`, v2);
+        }
+        for (const [n, , fs] of entries)
+            for (const f of Object.keys(fs))
+                if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
+                    throw new Error(`${n}: ${f} is not a plain fold name`);
+        const maps = entries.flatMap(([n, k, fs]) => [...k.vars(n), ...Object.keys(fs).map(f => `${n}$${f}`)]);
+        return this.with({ carried: [...(this.spec.carried ?? []), ...maps], inputs: [...this.spec.inputs, ...entries.map(([n]) => [`${n}_len`, nat])], lists2: [...(this.spec.lists2 ?? []), ...entries] });
+    }
     // Named conditions of the step, decided once per step before it; each call's flags may read the earlier calls'. A flag
     // named again replaces the earlier definition in place (what a variant needs: one call, the step unchanged); the new
     // definition may read only the flags defined before the original's place, as the kernel checks.
@@ -1384,6 +1516,22 @@ export class Rule {
         const [k1, more] = keysFor(out), holds = out.forall(v(k1), ...more.map(v)).c;
         return more.length ? { name, forall: k1, keys: more, holds } : { name, forall: k1, holds: prenex(holds, `law ${name}`, k1) ?? holds };
     }
+    // What the kinds keep true of the state and of the maps and lists of a kind (Kind.invariant: a flag 0 or 1, a choice or
+    // a case in range, a presence bit 0 or 1), as laws: proveRule, proveSteps and proveLeadsTo prove them beside the laws
+    // they are given, so a law may lean on "the hold is idle, holding or released" without stating it; give them to
+    // toLean (or the kernel) with the rest.
+    kindLaws() {
+        const out = [];
+        const of = (env, n) => env[n];
+        for (const [n, k] of this.spec.kinded ?? [])
+            if (k.invariant(k.value(n)).length)
+                out.push(this.law(`${n} is a value of its kind`, env => all(...k.invariant(of(env, n)))));
+        for (const [n, k] of [...this.spec.cells ?? [], ...this.spec.items ?? []])
+            if (k.invariant(k.value(n)).length) {
+                out.push(this.law(`every ${n} cell is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
+            }
+        return out;
+    }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
     // the request, state, maps, flags, sums, queries) to the state, maps and sums after it. `when` narrows the requests.
     //   counter.stepLaw('never goes back', ({used}, after) => used.atMost(after.used))
@@ -1456,6 +1604,8 @@ export class Rule {
     //   r.relate('the secret is irrelevant', (a, b) => a.user.eq(b.user), (a, b) => a.allowed.iff(b.allowed))
     relate(name, given, then) {
         const s = this.spec, b = (n) => `b.${n}`, own = [...s.inputs.map(([n]) => n), ...(s.carried ?? [])];
+        if (s.lists2?.length)
+            throw new Error(`${s.name}: a decision about two requests takes no carried list`);
         const second = (env) => ({ ...env, ...Object.fromEntries(own.map(n => [n, env[b(n)]])) });
         const pair = new Rule({ ...s, inputs: [...s.inputs, ...s.inputs.map(([n, k]) => [b(n), k])], carried: [...(s.carried ?? []), ...(s.carried ?? []).map(b)],
             assume: [...s.assume, ...s.assume.map(f => (env) => f(second(env)))], flags: [], step: undefined, record: undefined, sums: [], queries: [], keep: undefined, relations: undefined, prune: undefined });
@@ -1499,6 +1649,12 @@ export class Rule {
                 out[n] = k.value(n);
             for (const n of this.spec.carried ?? [])
                 out[n] = new MapRef(n, 0);
+            for (const [n, k, fs, ls] of this.spec.lists2 ?? []) {
+                const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0), ls);
+                for (const part of l.maps)
+                    delete out[part];
+                out[n] = l;
+            }
         }
         if (parts.state !== false) {
             for (const [n] of this.spec.state)
@@ -1609,7 +1765,7 @@ export class Rule {
                 state[n] = hoist.term(termOf(u));
         }
         const pre = [...this.kindAssumptions('params'), ...s.pre.map(f => f(pEnv).c)];
-        const assume = [...this.kindAssumptions('inputs'), ...s.assume.map(f => hoist.cond(f(env).c))];
+        const assume = [...this.kindAssumptions('inputs'), ...(s.lists2 ?? []).flatMap(([n]) => env[n].equations().map(c => hoist.cond(c.c))), ...s.assume.map(f => hoist.cond(f(env).c))];
         placed();
         // Functions, and their facts: each function's own (named after it), then the rule's.
         // The functions a function reads come first, each named <function>.<use>.
@@ -1821,9 +1977,16 @@ export class Rule {
     // Runtime values (numbers, booleans, choice names, null for a missing value) to the variables the machine reads.
     encodeParams(values) { return encode(this.spec.params, values); }
     // A carried map is a Set of keys (each cell 1), an array of them, or a Map of key to natural.
+    // A carried list is an array of its items' runtime values (its length and folds computed from them).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     encodeInput(values) {
-        const out = encode(this.spec.inputs, values);
+        const lists = Object.fromEntries((this.spec.lists2 ?? []).map(([n, k, fs]) => [n, new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(values[n])]));
+        const out = encode(this.spec.inputs, { ...values, ...Object.fromEntries(Object.entries(lists).map(([n, l]) => [`${n}_len`, l.len])) });
+        for (const l of Object.values(lists))
+            Object.assign(out, l.maps);
         for (const n of this.spec.carried ?? []) {
+            if (n in out)
+                continue;
             const given = values[n];
             out[n] = given instanceof Map ? new Map(given) : new Map([...given].map(key => [key, 1]));
         }
@@ -1835,6 +1998,11 @@ export class Rule {
         const out = Object.assign({}, ...this.spec.inputs.map(([n, k]) => k.random(n, rand, bound)));
         for (const n of this.spec.carried ?? [])
             out[n] = new Map(Array.from({ length: bound + 1 }, (_, key) => [key, rand(2)]).filter(([, cell]) => cell === 1));
+        // A carried list: items drawn by their kind, its length and folds as the encoding computes them.
+        for (const [n, k, fs] of this.spec.lists2 ?? []) {
+            const l = new CarriedList(n, k, v(`${n}_len`), fs, part => new MapRef(part, 0)).encode(Array.from({ length: rand(bound + 1) }, () => k.sample(rand, bound)));
+            Object.assign(out, l.maps, { [`${n}_len`]: l.len });
+        }
         return out;
     }
     // The state's scalars as runtime values: each kinded variable as its kind decodes it (an integer as one signed
@@ -1876,7 +2044,7 @@ const encode = (kinds, values) => Object.assign({}, ...kinds.map(([n, k]) => k.e
 export const rule = (name) => new Rule({ name, params: [], inputs: [], state: [], maps: [], flags: [], pre: [], assume: [], sums: [], queries: [] });
 // The kind a result field is kept in.
 const kindOf = (t) => (t instanceof Cond ? bool : t instanceof Int ? int : t instanceof Decimal ? decimal(t.places) : t instanceof Choice ? oneOf(...t.values) : t instanceof Str ? str({ like: t.patterns })
-    : t instanceof Variant ? t.kind : isRecord(t) ? record(Object.fromEntries(Object.entries(t).map(([f, x]) => [f, kindOf(x)]))) : nat);
+    : t instanceof Variant ? t.kind : t instanceof Maybe ? maybe(kindOf(t.inner)) : isRecord(t) ? record(Object.fromEntries(Object.entries(t).map(([f, x]) => [f, kindOf(x)]))) : nat);
 export class Fun {
     r;
     out;
@@ -2019,16 +2187,18 @@ const goalsVerdict = (goals) => {
     }
     return { proven: true, checked: goals.every(g => check(g, trees[g.name])), trees };
 };
+// The kinds' laws first, those the caller didn't pass already (by name).
+const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.name === k.name)), ...laws];
 export function proveRule(r, laws) {
-    const out = proveLaws(r.machine, laws);
+    const out = proveLaws(r.machine, withKinds(r, laws));
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveSteps(r, laws, stepLaws) {
-    const out = proveStepLaws(r.machine, laws, stepLaws);
+    const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveLeadsTo(r, laws, l) {
-    const out = proveLiveness(r.machine, laws, l);
+    const out = proveLiveness(r.machine, withKinds(r, laws), l);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export const proveDecision = (d) => goalsVerdict([d.goal]);
@@ -2059,3 +2229,112 @@ export function crossCheckDecision(d, opts = {}) {
     return { checked };
 }
 export const proveLoop = (l, laws) => goalsVerdict(loopObligations(l.loop, laws, l.rankTerms));
+export class FoldRule {
+    spec;
+    constructor(spec) {
+        this.spec = spec;
+    }
+    with(more) { return new FoldRule({ ...this.spec, ...more }); }
+    get name() { return this.spec.name; }
+    params(kinds) { return this.with({ params: [...this.spec.params, ...Object.entries(kinds)] }); }
+    inputs(kinds) { return this.with({ inputs: [...this.spec.inputs, ...Object.entries(kinds)] }); }
+    pre(f) { return this.with({ pre: [...this.spec.pre, f] }); }
+    // What every leaf's and node's inputs satisfy (with their kinds' own assumptions).
+    assume(f) { return this.with({ assume: [...this.spec.assume, f] }); }
+    leaf(f) { return this.with({ leaf: f }); }
+    node(f) { return this.with({ node: f }); }
+    env(inputs = true) {
+        const out = {};
+        for (const [n, k] of this.spec.params)
+            out[n] = k.value(n);
+        if (inputs)
+            for (const [n, k] of this.spec.inputs)
+                out[n] = k.value(n);
+        return out;
+    }
+    names() {
+        if (!this.spec.leaf)
+            throw new Error(`${this.spec.name}: a fold needs a leaf`);
+        return Object.keys(this.spec.leaf(this.env()));
+    }
+    side(prefix) { return Object.fromEntries(this.names().map(n => [n, v(`${prefix}${n}`)])); }
+    // A law about the values (and the params): it reads no input.
+    law(name, f) { return { name, holds: f({ ...this.env(false), ...this.side('') }).c }; }
+    get fold() {
+        const s = this.spec;
+        if (!s.leaf || !s.node)
+            throw new Error(`${s.name}: a fold needs a leaf and a node`);
+        const env = this.env(), pEnv = this.env(false);
+        const pre = [...s.params.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.pre.map(f => f(pEnv).c)];
+        const assume = [...s.inputs.flatMap(([n, k]) => k.assume(n)).map(c => c.c), ...s.assume.map(f => f(env).c)];
+        const terms = (r) => Object.fromEntries(Object.entries(r).map(([n, t]) => [n, termOf(t)]));
+        const leaf = terms(s.leaf(env)), node = terms(s.node(env, this.side('l_'), this.side('r_')));
+        return { name: s.name, params: s.params.flatMap(([n, k]) => k.vars(n)), inputs: s.inputs.flatMap(([n, k]) => k.vars(n)), leaf, node,
+            ...(pre.length ? { pre: pre.length === 1 ? pre[0] : { op: 'and', xs: pre } } : {}), ...(assume.length ? { assume: assume.length === 1 ? assume[0] : { op: 'and', xs: assume } } : {}) };
+    }
+    // The values of a tree, by the terms that were proven (each leaf's and node's inputs as their kinds encode them; one
+    // that doesn't meet `assume` is refused, as the laws are claimed only of trees that meet it).
+    run(tree, params = {}) {
+        const f = this.fold, ps = encode(this.spec.params, params), none = { name: f.name, params: [], inputs: [], state: {}, step: {} };
+        const st = { scalars: {}, maps: {} };
+        if (f.pre && !evalC(f.pre, ps, st, none))
+            throw new RangeError(`${f.name}: the params don't meet its precondition`);
+        const go = (t) => {
+            const own = 'leaf' in t ? t.leaf : t.node, env = { ...ps, ...encode(this.spec.inputs, own) };
+            if (f.assume && !evalC(f.assume, env, st, none))
+                throw new RangeError(`${f.name}: ${JSON.stringify(own)} doesn't meet its assumption`);
+            if ('leaf' in t)
+                return Object.fromEntries(Object.entries(f.leaf).map(([n, e]) => [n, evalE(e, env, st, none)]));
+            const l = go(t.left), r = go(t.right);
+            const both = { ...env, ...Object.fromEntries(Object.entries(l).map(([n, x]) => [`l_${n}`, x])), ...Object.fromEntries(Object.entries(r).map(([n, x]) => [`r_${n}`, x])) };
+            return Object.fromEntries(Object.entries(f.node).map(([n, e]) => [n, evalE(e, both, st, none)]));
+        };
+        return go(tree);
+    }
+    // The builders against what they built, on random trees: each value by the callbacks' own arithmetic against the
+    // terms the kernel proved (as run evaluates them), and each law's callback against its condition.
+    crossCheck(laws = [], opts = {}) {
+        const s = this.spec, rand = opts.rand ?? seeded(13), bound = opts.bound ?? 6, f = this.fold;
+        let checked = 0;
+        const sample = (kinds) => Object.fromEntries(kinds.map(([n, k]) => [n, k.sample(rand, bound)]));
+        const tree = (d) => (d === 0 || rand(3) === 0 ? { leaf: sample(s.inputs) } : { node: sample(s.inputs), left: tree(d - 1), right: tree(d - 1) });
+        const known = (vals) => Object.fromEntries(Object.entries(vals).map(([n, x]) => [n, new Term({ op: 'const', value: x }, x)]));
+        for (let t = 0; t < (opts.trials ?? 200); t++) {
+            const params = sample(s.params), ps = encode(s.params, params);
+            const pv = known(ps), pEnv = Object.fromEntries(s.params.map(([n, k]) => [n, k.build(n, part => pv[part])]));
+            const builder = (tr) => {
+                const own = 'leaf' in tr ? tr.leaf : tr.node, iv = known(encode(s.inputs, own)), env = { ...pEnv, ...Object.fromEntries(s.inputs.map(([n, k]) => [n, k.build(n, part => iv[part])])) };
+                const out = 'leaf' in tr ? s.leaf(env) : (() => { const l = builder(tr.left), r = builder(tr.right); return l && r ? s.node(env, known(l), known(r)) : undefined; })();
+                if (!out)
+                    return undefined;
+                const vals = Object.entries(out).map(([n, x]) => [n, valOf(x)]);
+                return vals.every(([, x]) => x !== undefined) ? Object.fromEntries(vals) : undefined;
+            };
+            const tr = tree(opts.depth ?? 3);
+            let ours;
+            try {
+                ours = this.run(tr, params);
+            }
+            catch {
+                continue;
+            }
+            const theirs = builder(tr);
+            if (!theirs)
+                continue;
+            for (const [n, x] of Object.entries(theirs)) {
+                checked++;
+                if (ours[n] !== x)
+                    return { checked, failure: `${f.name}: ${n} is ${x} by its callbacks, ${ours[n]} by the terms proven, for ${JSON.stringify(tr)}` };
+            }
+            for (const law of laws) {
+                const ok = evalC(law.holds, { ...ps, ...ours }, { scalars: {}, maps: {} }, { name: f.name, params: [], inputs: [], state: {}, step: {} });
+                checked++;
+                if (!ok)
+                    return { checked, failure: `${f.name}: law ${law.name} fails for ${JSON.stringify(tr)} with params ${JSON.stringify(params)}` };
+            }
+        }
+        return { checked };
+    }
+}
+export const fold = (name) => new FoldRule({ name, params: [], inputs: [], pre: [], assume: [] });
+export const proveFold = (f, laws) => goalsVerdict(foldObligations(f.fold, laws));

package/dist/core/gdp.d.ts

@@ -6,8 +6,8 @@ export type Mint<K extends string, A> = <S extends AnyNamed[]>(args: A, ...about
 export { Unproven };
 type AnyFun = Fun<any, any, any>;
 type Conditions<O> = {
-    [k in keyof O]: O[k] extends boolean ? k : never;
-}[keyof O] & string;
+    [k in keyof O & string]: O[k] extends boolean ? k : O[k] extends Record<string, unknown> ? `${k}.${Conditions<O[k]>}` : never;
+}[keyof O & string];
 type ArgsOf<F extends AnyFun> = Parameters<F['run']>[0];
 type ParamsOf<F extends AnyFun> = NonNullable<Parameters<F['run']>[1]>;
 export declare function guard<K extends string, F extends AnyFun>(prover: Prover<K>, fn: F, field: Conditions<ReturnType<F['run']>>, opts: {

package/dist/core/gdp.js

@@ -4,6 +4,7 @@ import { allowed, requestEnv } from "./watch.js";
 export { Unproven };
 const proven = (what, v) => { if (!(v.proven && v.checked))
     throw new Unproven(what, v); };
+const atPath = (o, path) => path.split('.').reduce((x, f) => (typeof x === 'object' && x !== null ? x[f] : undefined), o);
 // A proof wherever `fn`'s result `field` holds. Every law in `laws` must have been stated about `fn` (fn.law or
 // fn.relate) and is proven now; the arguments it is later called with must meet the function's kinds and `assume`.
 //   const access = fun('document access').inputs({...}).returns(env => ({permit: permit(env)}))
@@ -23,7 +24,7 @@ export function guard(prover, fn, field, opts) {
         const input = r.encodeInput(args);
         if (m.assume && !evalC(m.assume, { ...ps, ...input }, { scalars: {}, maps: {} }, m))
             return null;
-        return fn.run(args, params)[field] === true ? prover.prove(...about) : null;
+        return atPath(fn.run(args, params), field) === true ? prover.prove(...about) : null;
     };
 }
 // A proof for each request whose step takes `flag`, the rule's laws (and step laws) proven now. One gate holds one

package/dist/core/machine.d.ts

@@ -88,6 +88,16 @@ export type Recurrence = {
         arity: number;
         lean?: string;
     }>;
+    proofs?: {
+        lemmas?: {
+            machine: Machine;
+            laws: Law[];
+        };
+        between?: {
+            machine: Machine;
+            laws: Law[];
+        };
+    };
 };
 export type History = {
     keep: C;