gdp-wired 0.8.0 → 0.9.0

package/README.md

@@ -209,8 +209,11 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
 - **Records and variants**: `record({limit: nat, blocked: bool})` hands out an object of its fields' values;
   `variant({card: {...}, cash: {...}})` a value with `is(case)` and `match({card: c => ..., cash: c => ...})`, the only
   place a case's fields are read. `Pay.make({tag: 'card', amount, verified})` builds a case to write or to pass to
-  `when`, and `same(a, b)` compares two values of one kind part by part. At runtime a record is an object of its fields
-  and a variant `{tag: 'card', ...fields}`; a field or case the kind doesn't declare is refused. Both are their fields'
+  `when`, and `same(a, b)` compares two values of one kind part by part; `optional(c, value)` is a value present where c
+  holds (a result that may be missing). At runtime a record is an object of its fields and a variant `{tag: 'card',
+  ...fields}` (or the key given, `variant({...}, {tag: 'kind'})`); a field or case the kind doesn't declare is refused.
+  What a kind keeps true of the values a step writes (a case in range, a flag 0 or 1) is a law of its own, `r.kindLaws()`,
+  which proveRule, proveSteps and proveLeadsTo prove beside the laws they are given. Both are their fields'
   variables underneath (`pay.card.amount`, and the case's index as `pay`), so the kernel, both runtimes and the Lean
   twin see nothing new. Maps and lists of them: `.maps({Acct: record({...}).from({...})})` (`Acct.at(k)`,
   `Acct.set(k, value)`, `Acct.each(k => value)`) and `.items({Queue: Job})` (`push`, `pop`, `set`, `insertAt`,
@@ -237,15 +240,17 @@ const soon = retry.law('the next try is at most 64 after the last request', ({ne
   own), and the Lean export takes them as the hypothesis they are, proving them where the function has a Lean
   definition. A function defined and proven in Lean is how a rule reaches past what the kernel decides: `examples/functions.ts`.
 - **Recurrences and their lemmas** (`recur(name, {args, fns, zero, next}, lemmas, between)`): f(0, a..) = zero and
-  f(x + 1, a..) = next(x, f(x, a..), a..), the further arguments `args` (up to three) fixed along the recursion, each term
-  the kernel's own or a read of a function in `fns` (`modBy(7)`, another recurrence). Each lemma is a law about every x
+  f(x + 1, a..) = next(x, f(x, a..), a..), the further arguments `args` (up to four) fixed along the recursion, each term
+  the kernel's own or a read of a function in `fns` (`modBy(7)`, another recurrence), the start's too. Each lemma is a law about every x
   and f(x), proven when the function is made, all of them together by induction (the recurrence run as a machine, each
   lemma a law of it, so one lemma may lean on another, and on the facts of the functions it reads); each law `between`
   is about every x <= y and f(x), f(y) ("never shrinks"), proven by induction on y from x, with the lemmas. One that
   isn't proven throws `Unproven` with the induction step it breaks at. The two equations, the lemmas and the laws
-  between are the function's facts. The runtimes compute f by the recurrence (x steps); the Lean export defines
-  `Recur.<name>` by it (a function of several arguments through an injective pairing, proven so in Lean) and proves
-  every fact there by induction (`examples/lemmas.ts`).
+  between are the function's facts. The runtimes compute f by the recurrence, continuing from the last value computed at
+  the same further arguments (a rule that reads f at a growing count takes one step a request); the Lean export defines
+  `Recur.<name>` by it (a function of several arguments through an injective pairing, proven so in Lean) and checks the
+  kernel's own proof of every lemma and law between: the machine it was proven by, with its trees, and the run of it that
+  reaches x and f(x), so a lemma with a product (squares: f(x) = x·x) needs no tactic of Lean's (`examples/lemmas.ts`).
 - **Liveness** (`rule.leadsTo(name, {from, to, rank, helpful})`, `proveLeadsTo`): whenever `from` holds, `to` holds later in
   every run that takes each helpful request infinitely often; proven by a rank no step raises while waiting and each
   helpful request lowers in its region. `rank` may return several terms (compared in order) and `helpful` may be a list

package/dist/core/dsl.d.ts

@@ -43,7 +43,7 @@ export declare function when<K extends string>(c: Cond, then: Choice<K>, otherwi
 export declare function when(c: Cond, then: Str, otherwise: Str): Str;
 export declare function when<V>(c: Cond, then: Maybe<V>, otherwise: Maybe<V>): Maybe<V>;
 export declare function when(c: Cond, then: Cond, otherwise: Cond): Cond;
-export declare function when<C extends Cases>(c: Cond, then: Variant<C>, otherwise: Variant<C>): Variant<C>;
+export declare function when<C extends Cases, T extends string>(c: Cond, then: Variant<C, T>, otherwise: Variant<C, T>): Variant<C, T>;
 export declare function when<T extends Record<string, unknown>>(c: Cond, then: T, otherwise: T): T;
 export declare const choose: (c: Cond, then: Cond, otherwise: Cond) => Cond;
 export declare function same(a: unknown, b: unknown): Cond;
@@ -65,6 +65,7 @@ export declare abstract class Kind<V> {
     abstract assume(name: string): Cond[];
     abstract build(name: string, get: (part: string) => Term): V;
     value(name: string, at?: At): V;
+    invariant(_value: V): Cond[];
     abstract encode(name: string, raw: Raw): Record<string, number>;
     abstract random(name: string, rand: Rand, bound: number): Record<string, number>;
     abstract store(name: string, value: unknown): Record<string, TermLike>;
@@ -152,6 +153,7 @@ export declare class Maybe<V> {
     }): Term;
 }
 export declare const maybe: <V>(of: Kind<V>) => Kind<Maybe<V>>;
+export declare const optional: <V>(c: Cond, value: V) => Maybe<V>;
 type Fields = Record<string, Kind<unknown>>;
 export declare const record: <const K extends Fields>(fields: K) => Kind<ValuesOf<K>>;
 type Cases = Record<string, Fields>;
@@ -161,40 +163,41 @@ type CaseValues<C extends Cases> = {
 type MatchCases<C extends Cases, T> = {
     [k in keyof C]: (fields: ValuesOf<C[k]>) => T;
 };
-export declare class Variant<C extends Cases = Cases> {
+export declare class Variant<C extends Cases = Cases, T extends string = 'tag'> {
     readonly tag: Term;
     readonly cases: CaseValues<C>;
-    readonly kind: VariantKind<C>;
-    constructor(tag: Term, cases: CaseValues<C>, kind: VariantKind<C>);
+    readonly kind: VariantKind<C, T>;
+    constructor(tag: Term, cases: CaseValues<C>, kind: VariantKind<C, T>);
     is(k: keyof C & string): Cond;
     match(cases: MatchCases<C, Cond>): Cond;
     match(cases: MatchCases<C, TermLike>): Term;
     match<T>(cases: MatchCases<C, T>): T;
 }
-export type VariantWrite<C extends Cases> = {
+export type VariantWrite<C extends Cases, T extends string = 'tag'> = {
     [k in keyof C]: {
-        [f in 'tag' | keyof C[k]]: f extends 'tag' ? k : C[k][f] extends Kind<infer V> ? Writes<V> : never;
+        [f in T | keyof C[k]]: f extends T ? k : C[k][f] extends Kind<infer V> ? Writes<V> : never;
     };
 }[keyof C];
-export declare class VariantKind<C extends Cases> extends Kind<Variant<C>> {
+export declare class VariantKind<C extends Cases, T extends string = 'tag'> extends Kind<Variant<C, T>> {
     readonly cases: C;
+    readonly tagKey: T;
     readonly names: (keyof C & string)[];
-    readonly tagKey = "tag";
-    constructor(cases: C);
+    constructor(cases: C, tagKey: T);
     index(k: string): number;
     private payload;
     private filled;
     private at;
     vars(name: string): string[];
     assume(name: string): Cond[];
-    build(name: string, get: (part: string) => Term): Variant<C>;
-    make(write: VariantWrite<C>): Variant<C>;
+    build(name: string, get: (part: string) => Term): Variant<C, T>;
+    invariant(x: Variant<C, T>): Cond[];
+    make(write: VariantWrite<C, T>): Variant<C, T>;
     store(name: string, value: unknown): Record<string, TermLike>;
     decode(name: string, vars: Record<string, number>): {
-        tag: keyof C & string;
+        [x: string]: (keyof C & string) | Raw;
     };
     empty(): {
-        tag: keyof C & string;
+        [x: string]: (keyof C & string) | Raw;
     };
     encode(name: string, raw: Raw): {
         [x: string]: number;
@@ -203,10 +206,13 @@ export declare class VariantKind<C extends Cases> extends Kind<Variant<C>> {
         [x: string]: number;
     };
     sample(rand: Rand, bound: number): {
-        tag: keyof C & string;
+        [x: string]: (keyof C & string) | Raw;
     };
 }
-export declare const variant: <const C extends Cases>(cases: C) => VariantKind<C>;
+export declare function variant<const C extends Cases>(cases: C): VariantKind<C>;
+export declare function variant<const C extends Cases, const T extends string>(cases: C, opts: {
+    tag: T;
+}): VariantKind<C, T>;
 export declare const intern: ((text: string) => number) & {
     load(entries: [string, number][]): void;
 };
@@ -326,7 +332,7 @@ export declare class ItemsRef<V> {
 export type Forall = {
     readonly forall: (key: Term, ...more: Term[]) => Cond;
 };
-export declare function forall(f: (key: Term, key2: Term, key3: Term, key4: Term) => Cond): Forall;
+export declare function forall(f: (key: Term, key2: Term, key3: Term, key4: Term, key5: Term, key6: Term) => Cond): Forall;
 export type Relation = {
     readonly when: Cond;
     readonly holds: Cond;
@@ -356,9 +362,7 @@ type RecurEnv<A extends string, U> = {
 export type RecurDef<A extends string, U extends Record<string, FnDef>> = {
     args?: readonly A[];
     fns?: U;
-    zero: TermLike | ((env: {
-        [a in A]: Term;
-    }) => TermLike);
+    zero: TermLike | ((env: RecurEnv<A, U>) => TermLike);
     next: (x: Term, prev: Term, env: RecurEnv<A, U>) => TermLike;
 };
 export declare const recur: <const A extends string = never, U extends Record<string, FnDef> = {}>(name: string, def: RecurDef<A, U>, lemmas?: Record<string, (x: Term, fx: Term, env: RecurEnv<A, U>) => Cond>, between?: Record<string, (x: Term, fx: Term, y: Term, fy: Term, env: RecurEnv<A, U>) => Cond>) => FnDef & {
@@ -369,7 +373,7 @@ type ValuesOf<K extends Kinds> = {
     [n in keyof K]: K[n] extends Kind<infer V> ? V : never;
 };
 type Obj = object;
-type Writes<V> = V extends Decimal ? DecimalLike | string : V extends Int ? IntLike : V extends Cond ? Cond | boolean : V extends Choice<infer K> ? Choice<K> | K : V extends Maybe<infer W> ? Maybe<W> | Writes<W> | null : V extends Str ? Str | string : V extends Variant<infer C> ? Variant<C> | VariantWrite<C> : V extends Term ? TermLike : V extends Record<string, unknown> ? {
+type Writes<V> = V extends Decimal ? DecimalLike | string : V extends Int ? IntLike : V extends Cond ? Cond | boolean : V extends Choice<infer K> ? Choice<K> | K : V extends Maybe<infer W> ? Maybe<W> | Writes<W> | null : V extends Str ? Str | string : V extends Variant<infer C, infer T> ? Variant<C, T> | VariantWrite<C, T> : V extends Term ? TermLike : V extends Record<string, unknown> ? {
     [k in keyof V]: Writes<V[k]>;
 } : TermLike;
 type Update<S extends Obj, M extends Obj> = Partial<{
@@ -458,6 +462,7 @@ export declare class Rule<P extends Obj = {}, I extends Obj = {}, S extends Obj
     prune(order: keyof R & string, after: (p: P) => TermLike): Rule<P, I, S, M, F, R, Su, Q>;
     law(name: string, f: (env: P & S & M & Su) => Cond | Forall): Law;
     private lawOf;
+    kindLaws(): Law[];
     stepLaw(name: string, then: (before: P & I & S & M & F & Su & Q, after: S & M & Su) => Cond | Forall, when?: (before: P & I & S & M & F & Su & Q) => Cond): StepLaw;
     stepsLaw(name: string, k: number, then: (first: P & I & S & M & F & Su & Q, last: S & M & Su, requests: (I & Q)[]) => Cond | Forall, when?: (before: P & I & S & M & F & Su & Q, j: number) => Cond | undefined): StepLaw;
     leadsTo(name: string, spec: {
@@ -552,18 +557,18 @@ export type Decision = {
     then: C;
     goal: Goal;
 };
-type ResultOf<V> = 0 extends 1 & V ? Term : [V] extends [Cond] ? Cond : [V] extends [Decimal] ? Decimal : [V] extends [Int] ? Int : [V] extends [Choice<infer K>] ? Choice<K> : [V] extends [Str] ? Str : [V] extends [Variant<infer C>] ? Variant<C> : [V] extends [Term | number] ? Term : [V] extends [Record<string, unknown>] ? {
+type ResultOf<V> = 0 extends 1 & V ? Term : [V] extends [Cond] ? Cond : [V] extends [Decimal] ? Decimal : [V] extends [Int] ? Int : [V] extends [Choice<infer K>] ? Choice<K> : [V] extends [Str] ? Str : [V] extends [Variant<infer C, infer T>] ? Variant<C, T> : [V] extends [Maybe<infer W>] ? Maybe<ResultOf<W>> : [V] extends [Term | number] ? Term : [V] extends [Record<string, unknown>] ? {
     [f in keyof V]: ResultOf<V[f]>;
 } : Term;
 type Result<T> = {
     [k in keyof T]: ResultOf<T[k]>;
 };
-type ValueOf<V> = 0 extends 1 & V ? number : [V] extends [Cond] ? boolean : [V] extends [Choice<infer K>] ? K : [V] extends [Str] ? string : [V] extends [Variant<infer C>] ? CaseRaw<C> : [V] extends [Term | number | Int | Decimal] ? number : [V] extends [Record<string, unknown>] ? {
+type ValueOf<V> = 0 extends 1 & V ? number : [V] extends [Cond] ? boolean : [V] extends [Choice<infer K>] ? K : [V] extends [Str] ? string : [V] extends [Variant<infer C, infer T>] ? CaseRaw<C, T> : [V] extends [Maybe<infer W>] ? ValueOf<W> | null : [V] extends [Term | number | Int | Decimal] ? number : [V] extends [Record<string, unknown>] ? {
     [f in keyof V]: ValueOf<V[f]>;
 } : number;
-type CaseRaw<C extends Cases> = {
+type CaseRaw<C extends Cases, T extends string = 'tag'> = {
     [k in keyof C]: {
-        tag: k;
+        [t in T]: k;
     } & {
         [f in keyof C[k]]: C[k][f] extends Kind<infer V> ? ValueOf<V> : never;
     };
@@ -571,7 +576,7 @@ type CaseRaw<C extends Cases> = {
 type Value<T> = {
     [k in keyof T]: ValueOf<T[k]>;
 };
-type Field = Term | Cond | Int | Decimal | Choice<string> | Str | Variant<any> | {
+type Field = Term | Cond | Int | Decimal | Choice<string> | Str | Variant<any, any> | Maybe<any> | {
     [f: string]: Field | number;
 };
 export declare class Fun<P extends Obj = {}, I extends Obj = {}, O extends Obj = {}> {

package/dist/core/dsl.js

@@ -158,6 +158,10 @@ const named = (at, n) => (typeof at === 'string' ? at + n : at(n));
 const primed = (n) => `${n}'`;
 export class Kind {
     value(name, at = '') { return this.build(name, part => v(named(at, part))); }
+    // What every value a step writes keeps true of its variables (a flag is 0 or 1, a choice or a case in range, a
+    // presence bit 0 or 1), unlike a bound such as upTo's, which a step may pass: the laws a rule's state and cells of the
+    // kind are proven to keep (Rule.kindLaws).
+    invariant(_value) { return []; }
     // A runtime value of the kind (what encode takes), for comparing a rule with the code it describes (compare).
     sample(_rand, _bound) { throw new Error('this kind draws no runtime values'); }
     // A state variable of this kind starting at a runtime value, or at a value over the params: `.state({open: bool.from(true)})`.
@@ -321,6 +325,7 @@ class BoolKind extends Kind {
     vars(name) { return [name]; }
     assume(name) { return [v(name).atMost(1)]; }
     build(name, get) { return new Bool(get(name)); }
+    invariant(b) { return [b.n.atMost(1)]; }
     store(name, value) { return { [name]: typeof value === 'boolean' ? (value ? 1 : 0) : count(value) }; }
     decode(name, vars) { return vars[name] === 1; }
     empty() { return false; }
@@ -370,6 +375,7 @@ class OneOfKind extends Kind {
     vars(name) { return [name]; }
     assume(name) { return [v(name).lt(this.values.length)]; }
     build(name, get) { return new Choice(get(name), this.values); }
+    invariant(c) { return [c.n.lt(this.values.length)]; }
     store(name, value) { return { [name]: value instanceof Choice ? value.n : this.encode(name, value)[name] }; }
     decode(name, vars) { return this.values[vars[name]]; }
     empty() { return this.values[0]; }
@@ -414,6 +420,7 @@ class MaybeKind extends Kind {
     vars(name) { return [this.has(name), ...this.of.vars(name)]; }
     assume(name) { return [v(this.has(name)).atMost(1), ...this.of.assume(name)]; }
     build(name, get) { return new Maybe(get(this.has(name)), this.of.build(name, get)); }
+    invariant(m) { return [m.present.atMost(1), ...this.of.invariant(m.inner)]; }
     // null for none, a Maybe as it is, any other value as some.
     store(name, value) {
         if (value === null || value === undefined)
@@ -435,6 +442,8 @@ class MaybeKind extends Kind {
     sample(rand, bound) { return rand(4) === 0 ? null : this.of.sample(rand, bound); }
 }
 export const maybe = (of) => new MaybeKind(of);
+// A value present where c holds and missing elsewhere (a function's result that may be missing, say).
+export const optional = (c, value) => new Maybe(count(c), value);
 const fieldName = (name, f) => `${name}.${f}`;
 const plainFields = (what, names) => { for (const f of names)
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f))
@@ -473,6 +482,7 @@ class RecordKind extends Kind {
     vars(name) { composite(name); return this.each((f, k) => k.vars(fieldName(name, f))).flat(); }
     assume(name) { return this.each((f, k) => k.assume(fieldName(name, f))).flat(); }
     build(name, get) { return Object.fromEntries(this.each((f, k) => [f, k.build(fieldName(name, f), get)])); }
+    invariant(r) { return this.each((f, k) => k.invariant(r[f])).flat(); }
     store(name, value) {
         const o = value;
         if (o === null || typeof o !== 'object')
@@ -516,19 +526,20 @@ export class Variant {
 }
 export class VariantKind extends Kind {
     cases;
+    tagKey;
     names;
-    tagKey = 'tag';
-    constructor(cases) {
+    constructor(cases, tagKey) {
         super();
         this.cases = cases;
+        this.tagKey = tagKey;
         this.names = Object.keys(cases);
         if (this.names.length === 0)
             throw new Error('a variant has a case');
         plainFields('variant', this.names);
         for (const k of this.names) {
             plainFields(`variant case ${k}`, Object.keys(cases[k]));
-            if ('tag' in cases[k])
-                throw new Error(`variant case ${k}: tag names the case, not a field`);
+            if (tagKey in cases[k])
+                throw new Error(`variant case ${k}: ${tagKey} names the case, not a field`);
         }
     }
     index(k) {
@@ -547,6 +558,7 @@ export class VariantKind extends Kind {
     }
     // The value of a case with these fields (terms, values or runtime values), to compare, match or pass to `when`:
     //   when(held, At.make({tag: 'holding', amount, since: now}), at)
+    invariant(x) { return [x.tag.lt(this.names.length), ...this.names.filter(k => this.filled(k)).flatMap(k => this.payload(k).invariant(x.cases[k]))]; }
     make(write) {
         const parts = this.store('$', write);
         return this.build('$', part => { const t = parts[part]; return typeof t === 'number' ? lit(t) : t; });
@@ -586,7 +598,12 @@ export class VariantKind extends Kind {
     }
     sample(rand, bound) { const k = this.names[rand(this.names.length)]; return { [this.tagKey]: k, ...(this.filled(k) ? this.payload(k).sample(rand, bound) : {}) }; }
 }
-export const variant = (cases) => new VariantKind(cases);
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function variant(cases, opts = {}) {
+    if (opts.tag !== undefined && !/^[A-Za-z_][A-Za-z0-9_]*$/.test(opts.tag))
+        throw new Error(`variant: ${opts.tag} is not a plain key`);
+    return new VariantKind(cases, opts.tag ?? 'tag');
+}
 // A string, encoded as its interned name, its length and one bit per pattern the kind declares (`like`, Cedar's glob:
 // `*` any run of characters, `\*` a star): all computed from the string itself when the input is encoded, so the bits
 // are the string's, not an answer someone supplies. Names come from one table per process, the empty string 0; a law
@@ -1084,7 +1101,7 @@ export const modBy = (c) => {
             [`r(x + ${c}) = r(x)`]: forall(x => f(x.plus(c)).eq(f(x))),
         }) });
 };
-const reservedInRecur = ['x', 'fx', 'y', 'fy', 'prev', 'x0'];
+const reservedInRecur = ['x', 'fx', 'y', 'fy', 'prev', 'x0', 'fx0'];
 export const recur = (name, def, lemmas = {}, between = {}) => {
     const plain = /^[A-Za-z][A-Za-z0-9_]*$/;
     if (!plain.test(name))
@@ -1094,15 +1111,13 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         if (!plain.test(n) || reservedInRecur.includes(n) || n === name)
             throw new Error(`recur ${name}: ${n} can't name an argument or a function here (${reservedInRecur.join(', ')} and ${name} are taken)`);
     distinctNames(`recur ${name}`, [...args, ...uses.map(([u]) => u)]);
-    if (args.length > 2 && Object.keys(between).length)
-        throw new Error(`recur ${name}: a law between two points takes at most two further arguments`);
-    if (args.length > 3)
-        throw new Error(`recur ${name}: at most three further arguments`);
+    if (args.length > 4)
+        throw new Error(`recur ${name}: at most four further arguments`);
     const named = (n) => new Term({ op: 'var', name: n });
     const argsAt = (ts) => Object.fromEntries(args.map((a, i) => [a, ts[i]]));
     const usesAt = (at) => Object.fromEntries(uses.map(([u, d]) => [u, fnTerm(at(u), d)]));
     const envAt = (ts, at = u => u) => ({ ...argsAt(ts), ...usesAt(at) });
-    const zeroAt = (ts) => (typeof def.zero === 'function' ? def.zero(argsAt(ts)) : def.zero);
+    const zeroAt = (ts, at = u => u) => (typeof def.zero === 'function' ? def.zero(envAt(ts, at)) : def.zero);
     // The recurrence over named variables (x, prev, the arguments; lemmas over x and fx; laws between over x, fx, y, fy),
     // the functions it reads by their own names: what the runtimes and the Lean export are made from.
     const own = args.map(named);
@@ -1117,7 +1132,7 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
             if (!maps.includes(m))
                 throw new Error(`recur ${name}: ${what} reads a function or a map it isn't given (${m})`);
     };
-    only('zero', zero, args, []);
+    only('zero', zero, args, uses.map(([u]) => u));
     only('next', next, ['x', 'prev', ...args], uses.map(([u]) => u));
     const stated = Object.entries(lemmas).map(([n, f]) => { const holds = f(named('x'), named('fx'), envAt(own)).c; only(`lemma "${n}"`, holds, ['x', 'fx', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
     const pairs = Object.entries(between).map(([n, f]) => { const holds = f(named('x'), named('fx'), named('y'), named('fy'), envAt(own)).c; only(`law between "${n}"`, holds, ['x', 'fx', 'y', 'fy', ...args], uses.map(([u]) => u)); return { name: n, holds }; });
@@ -1126,44 +1141,55 @@ export const recur = (name, def, lemmas = {}, between = {}) => {
         throw new Unproven(`${name}'s ${what}`, v); };
     // The lemmas: x counting up from 0 and fx its value, each lemma a law of that machine.
     let verdict = { proven: true, checked: true };
+    const proofs = {};
     if (stated.length) {
-        const r = rule(`${name}, by induction`).params(argKinds).fns(def.fns ?? {}).inputs({}).state({ x: 0, fx: ((p) => zeroAt(args.map(a => p[a]))) })
+        // A start that reads a function is a param given as that start by a fact (a start reads the params alone).
+        const zeroReads = JSON.stringify(zero).includes('"op":"get"');
+        let r0 = rule(`${name}, by induction`).params({ ...argKinds, ...(zeroReads ? { fx0: nat } : {}) }).fns(def.fns ?? {}).inputs({});
+        if (zeroReads)
+            r0 = r0.facts((p) => ({ [`fx0 is ${name}(0)`]: p.fx0.eq(zeroAt(args.map(a => p[a]))) }));
+        const r = r0.state({ x: 0, fx: ((p) => (zeroReads ? p.fx0 : zeroAt(args.map(a => p[a])))) })
             .step((env) => ({ x: env.x.plus(1), fx: def.next(env.x, env.fx, envAt(args.map(a => env[a]))) }));
-        verdict = proveRule(r, Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a]))))));
+        const laws = Object.entries(lemmas).map(([n, f]) => r.law(n, (env) => f(env.x, env.fx, envAt(args.map(a => env[a])))));
+        verdict = proveRule(r, laws);
         failed('lemmas', verdict);
+        proofs.lemmas = { machine: r.machine, laws };
     }
     const js = recurJs(name, args, zero, next, uses);
-    const recurrence = { args, zero, next, lemmas: stated, between: pairs, uses: Object.fromEntries(uses.map(([u, d]) => [u, { arity: d.arity, ...(d.lean ? { lean: d.lean } : {}) }])) };
+    const recurrence = { args, zero, next, lemmas: stated, between: pairs, uses: Object.fromEntries(uses.map(([u, d]) => [u, { arity: d.arity, ...(d.lean ? { lean: d.lean } : {}) }])), proofs };
     // A law about every n keys (forall counts them by the callback's own parameters).
     const keysOf = (n) => (f) => {
         if (n === 0)
             return f();
-        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d)][n - 1];
+        const by = [(a) => f(a), (a, b) => f(a, b), (a, b, c) => f(a, b, c), (a, b, c, d) => f(a, b, c, d),
+            (a, b, c, d, e) => f(a, b, c, d, e), (a, b, c, d, e, g) => f(a, b, c, d, e, g)][n - 1];
         return forall(by);
     };
     const facts = (withBetween) => (f, at = {}) => {
         const env = (ts) => ({ ...argsAt(ts), ...Object.fromEntries(uses.map(([u, d]) => [u, at[u] ?? fnTerm(u, d)])) });
         return {
-            [`${name}(0)`]: keysOf(args.length)((...as) => f(0, ...as).eq(zeroAt(as))),
+            [`${name}(0)`]: keysOf(args.length)((...as) => f(0, ...as).eq(typeof def.zero === 'function' ? def.zero(env(as)) : def.zero)),
             [`${name}(x + 1)`]: keysOf(1 + args.length)((k, ...as) => f(k.plus(1), ...as).eq(def.next(k, f(k, ...as), env(as)))),
             ...Object.fromEntries(Object.entries(lemmas).map(([n, l]) => [n, keysOf(1 + args.length)((k, ...as) => l(k, f(k, ...as), env(as)))])),
             ...(withBetween ? Object.fromEntries(Object.entries(between).map(([n, l]) => [n, keysOf(2 + args.length)((k, j, ...as) => k.atMost(j).implies(l(k, f(k, ...as), j, f(j, ...as), env(as))))])) : {}),
         };
     };
     const base = { arity: 1 + args.length, js, lean: `Recur.${name}`, recur: recurrence, ...(uses.length ? { uses: def.fns } : {}) };
-    // The laws between two points: y counting up from x, fy from f(x) (a param, given as f(x) by a fact), each law a law
-    // of that machine beside "fy is f(y)", which lets the lemmas speak at y.
+    // The laws between two points: y counting up from x and fy from fx, a value at x that meets the lemmas (as f(x)
+    // does: they are given of it, as facts of the params), each law a law of that machine beside the lemmas at y. What
+    // holds there for every such fx holds for f(x), and fy is f(y) by the recurrence; the machine reads no f at all.
     if (pairs.length) {
-        const self = { ...base, facts: facts(false) };
-        const r = rule(`${name}, between`).params({ ...argKinds, x: nat, fx: nat }).fns({ [name]: self }).inputs({})
-            .facts(((p) => ({ [`fx is ${name}(x)`]: p.fx.eq(p[name](p.x, ...args.map(a => p[a]))) })))
-            .state({ y: ((p) => p.x), fy: ((p) => p.fx) })
-            .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(args.map(a => env[a]), u => `${name}.${u}`)) }));
         const at = (env) => args.map(a => env[a]);
-        const laws = [r.law(`fy is ${name}(y)`, (env) => env.fy.eq(env[name](env.y, ...at(env)))),
-            ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env), u => `${name}.${u}`))))];
+        let r0 = rule(`${name}, between`).params({ ...argKinds, x: nat, fx: nat }).fns(def.fns ?? {}).inputs({});
+        if (stated.length)
+            r0 = r0.facts((p) => Object.fromEntries(Object.entries(lemmas).map(([n, l]) => [`${n} at x`, l(p.x, p.fx, envAt(at(p)))])));
+        const r = r0.state({ y: ((p) => p.x), fy: ((p) => p.fx) })
+            .step((env) => ({ y: env.y.plus(1), fy: def.next(env.y, env.fy, envAt(at(env))) }));
+        const laws = [...Object.entries(lemmas).map(([n, l]) => r.law(`${n} at y`, (env) => l(env.y, env.fy, envAt(at(env))))),
+            ...Object.entries(between).map(([n, l]) => r.law(n, (env) => l(env.x, env.fx, env.y, env.fy, envAt(at(env)))))];
         const v = proveRule(r, laws);
         failed('laws between two points', v);
+        proofs.between = { machine: r.machine, laws };
         verdict = { proven: true, checked: verdict.checked && v.checked };
     }
     return { ...base, verdict, facts: facts(true) };
@@ -1201,7 +1227,9 @@ const recurJs = (name, args, zero, next, uses) => {
         }
     };
     const inlined = uses.map(([u, d], i) => `const $f${i} = (${fnSource(u, d)}); `).join('');
-    return `(x, ${args.map(a => `${a}, `).join('')}) => { ${inlined}let prev = ${js(zero)}; for (let x0 = 0; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } return prev; }`;
+    // The last value computed at each tuple of further arguments is kept, so reading f at x after f at a smaller x takes
+    // only the steps between (a rule that reads f at a count that grows costs one step a request).
+    return `(() => { ${inlined}const $memo = new Map(); return (x, ${args.map(a => `${a}, `).join('')}) => { const $k = ${args.length ? `[${args.join(', ')}].join()` : "''"}; let $at = $memo.get($k); if (!$at || $at[0] > x) $at = [0, ${js(zero)}]; let x0 = $at[0], prev = $at[1]; for (; x0 < x; x0++) { prev = ((x, prev) => ${js(next)})(x0, prev); if (!Number.isSafeInteger(prev)) throw new RangeError(${JSON.stringify(`${name} passes the safe integers`)}); } if ($memo.size > 4096) $memo.clear(); $memo.set($k, [x, prev]); return prev; }; })()`;
 };
 // Functions with the functions they read, those first (named <function>.<use>), each with the terms its facts read them by.
 const flatFns = (defs) => defs.flatMap(([n, d]) => {
@@ -1223,7 +1251,7 @@ const fnSource = (name, d) => {
     }
     if (d.arity === 1)
         return src;
-    return `k => { const u = z => { let s = Math.floor(Math.sqrt(z)); while (s * s > z) s--; while ((s + 1) * (s + 1) <= z) s++; return [s - (z - s * s), z - s * s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return (${src})(...a); }`;
+    return `(() => { const $fn = (${src}); return k => { const u = z => { let s = Math.floor(Math.sqrt(z)); while (s * s > z) s--; while ((s + 1) * (s + 1) <= z) s++; return [s - (z - s * s), z - s * s]; }; const a = []; let z = k; for (let i = 1; i < ${d.arity}; i++) { const [p, q] = u(z); a.unshift(q); z = p; } a.unshift(z); return $fn(...a); }; })()`;
 };
 const fnTerm = (name, d) => (...args) => {
     if (args.length !== d.arity)
@@ -1384,6 +1412,22 @@ export class Rule {
         const [k1, more] = keysFor(out), holds = out.forall(v(k1), ...more.map(v)).c;
         return more.length ? { name, forall: k1, keys: more, holds } : { name, forall: k1, holds: prenex(holds, `law ${name}`, k1) ?? holds };
     }
+    // What the kinds keep true of the state and of the maps and lists of a kind (Kind.invariant: a flag 0 or 1, a choice or
+    // a case in range, a presence bit 0 or 1), as laws: proveRule, proveSteps and proveLeadsTo prove them beside the laws
+    // they are given, so a law may lean on "the hold is idle, holding or released" without stating it; give them to
+    // toLean (or the kernel) with the rest.
+    kindLaws() {
+        const out = [];
+        const of = (env, n) => env[n];
+        for (const [n, k] of this.spec.kinded ?? [])
+            if (k.invariant(k.value(n)).length)
+                out.push(this.law(`${n} is a value of its kind`, env => all(...k.invariant(of(env, n)))));
+        for (const [n, k] of [...this.spec.cells ?? [], ...this.spec.items ?? []])
+            if (k.invariant(k.value(n)).length) {
+                out.push(this.law(`every ${n} cell is a value of its kind`, env => forall(key => all(...k.invariant(of(env, n).at(key))))));
+            }
+        return out;
+    }
     // A law about one step, for every request the rule allows: `then(before, after)` relates what the step reads (params,
     // the request, state, maps, flags, sums, queries) to the state, maps and sums after it. `when` narrows the requests.
     //   counter.stepLaw('never goes back', ({used}, after) => used.atMost(after.used))
@@ -1876,7 +1920,7 @@ const encode = (kinds, values) => Object.assign({}, ...kinds.map(([n, k]) => k.e
 export const rule = (name) => new Rule({ name, params: [], inputs: [], state: [], maps: [], flags: [], pre: [], assume: [], sums: [], queries: [] });
 // The kind a result field is kept in.
 const kindOf = (t) => (t instanceof Cond ? bool : t instanceof Int ? int : t instanceof Decimal ? decimal(t.places) : t instanceof Choice ? oneOf(...t.values) : t instanceof Str ? str({ like: t.patterns })
-    : t instanceof Variant ? t.kind : isRecord(t) ? record(Object.fromEntries(Object.entries(t).map(([f, x]) => [f, kindOf(x)]))) : nat);
+    : t instanceof Variant ? t.kind : t instanceof Maybe ? maybe(kindOf(t.inner)) : isRecord(t) ? record(Object.fromEntries(Object.entries(t).map(([f, x]) => [f, kindOf(x)]))) : nat);
 export class Fun {
     r;
     out;
@@ -2019,16 +2063,18 @@ const goalsVerdict = (goals) => {
     }
     return { proven: true, checked: goals.every(g => check(g, trees[g.name])), trees };
 };
+// The kinds' laws first, those the caller didn't pass already (by name).
+const withKinds = (r, laws) => [...r.kindLaws().filter(k => !laws.some(l => l.name === k.name)), ...laws];
 export function proveRule(r, laws) {
-    const out = proveLaws(r.machine, laws);
+    const out = proveLaws(r.machine, withKinds(r, laws));
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveSteps(r, laws, stepLaws) {
-    const out = proveStepLaws(r.machine, laws, stepLaws);
+    const out = proveStepLaws(r.machine, withKinds(r, laws), stepLaws);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export function proveLeadsTo(r, laws, l) {
-    const out = proveLiveness(r.machine, laws, l);
+    const out = proveLiveness(r.machine, withKinds(r, laws), l);
     return { proven: out.proven, checked: out.checked, ...(out.failed ? { goal: out.failed.goal, stuck: out.failed.stuck, ...(out.failed.witness ? { witness: out.failed.witness } : {}), ...(out.failed.why ? { why: out.failed.why } : {}) } : {}) };
 }
 export const proveDecision = (d) => goalsVerdict([d.goal]);

package/dist/core/gdp.d.ts

@@ -6,8 +6,8 @@ export type Mint<K extends string, A> = <S extends AnyNamed[]>(args: A, ...about
 export { Unproven };
 type AnyFun = Fun<any, any, any>;
 type Conditions<O> = {
-    [k in keyof O]: O[k] extends boolean ? k : never;
-}[keyof O] & string;
+    [k in keyof O & string]: O[k] extends boolean ? k : O[k] extends Record<string, unknown> ? `${k}.${Conditions<O[k]>}` : never;
+}[keyof O & string];
 type ArgsOf<F extends AnyFun> = Parameters<F['run']>[0];
 type ParamsOf<F extends AnyFun> = NonNullable<Parameters<F['run']>[1]>;
 export declare function guard<K extends string, F extends AnyFun>(prover: Prover<K>, fn: F, field: Conditions<ReturnType<F['run']>>, opts: {

package/dist/core/gdp.js

@@ -4,6 +4,7 @@ import { allowed, requestEnv } from "./watch.js";
 export { Unproven };
 const proven = (what, v) => { if (!(v.proven && v.checked))
     throw new Unproven(what, v); };
+const atPath = (o, path) => path.split('.').reduce((x, f) => (typeof x === 'object' && x !== null ? x[f] : undefined), o);
 // A proof wherever `fn`'s result `field` holds. Every law in `laws` must have been stated about `fn` (fn.law or
 // fn.relate) and is proven now; the arguments it is later called with must meet the function's kinds and `assume`.
 //   const access = fun('document access').inputs({...}).returns(env => ({permit: permit(env)}))
@@ -23,7 +24,7 @@ export function guard(prover, fn, field, opts) {
         const input = r.encodeInput(args);
         if (m.assume && !evalC(m.assume, { ...ps, ...input }, { scalars: {}, maps: {} }, m))
             return null;
-        return fn.run(args, params)[field] === true ? prover.prove(...about) : null;
+        return atPath(fn.run(args, params), field) === true ? prover.prove(...about) : null;
     };
 }
 // A proof for each request whose step takes `flag`, the rule's laws (and step laws) proven now. One gate holds one

package/dist/core/machine.d.ts

@@ -88,6 +88,16 @@ export type Recurrence = {
         arity: number;
         lean?: string;
     }>;
+    proofs?: {
+        lemmas?: {
+            machine: Machine;
+            laws: Law[];
+        };
+        between?: {
+            machine: Machine;
+            laws: Law[];
+        };
+    };
 };
 export type History = {
     keep: C;

package/dist/lean-kernel/emit.d.ts

@@ -92,6 +92,7 @@ export declare function smachineToLean(id: string, given: Machine, laws: Law[],
             loop: Loop;
         };
     };
+    noFacts?: boolean;
 }): string;
 type Uses = Record<string, {
     lean?: string;