gdp-wired 0.18.0 → 0.20.0

package/dist/core/data.js

@@ -1,6 +1,7 @@
 import { substC, substE } from "../kernel/kernel.js";
 import { proveCyclic } from "./cyclic.js";
-import { pairedKeys, withDeadline } from "../kernel/prove.js";
+import { clock, counted, pairedKeys, withDeadline } from "../kernel/prove.js";
+import { work } from "./solver.js";
 // --- sorts and the AST ------------------------------------------------------------------------------------------------
 export const self = { self: true };
 export const natural = 'nat';
@@ -22,6 +23,14 @@ export class Nat {
     atLeast(b) { return new Bool({ op: '<=', a: natX(b), b: this.x }); }
     eq(b) { return new Bool({ op: '=', a: this.x, b: natX(b) }); }
     ne(b) { return this.eq(b).not(); }
+    // A natural as 0 or the successor of another (`pred`): recursion on a natural passes `pred` where this is a parameter.
+    // oxlint-disable-next-line typescript/no-explicit-any
+    match(cases) {
+        const pred = bindName('pred'), zero = cases.zero(), succ = cases.succ({ pred: new Nat({ op: 'var', name: pred }) });
+        const body = (o) => (typeof o === 'number' ? natX(o) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
+        const x = { op: 'natmatch', of: this.x, zero: body(zero), pred, succ: body(succ) };
+        return (zero instanceof Bool ? new Bool({ op: 'holds', x }) : zero instanceof Val ? new Val(zero.data, x) : new Nat(x));
+    }
 }
 const natX = (t) => (typeof t === 'number' ? { op: 'nat', value: t } : t.x);
 export class Bool {
@@ -53,7 +62,7 @@ export class Val {
             if (!f)
                 throw new Error(`${d.name}: match has no case ${c.name}`);
             const binds = c.fields.map(fl => bindName(fl.name));
-            const fields = Object.fromEntries(c.fields.map((fl, i) => [fl.name, wrap(fl.sort === 'nat' ? 'nat' : d, { op: 'var', name: binds[i] })]));
+            const fields = Object.fromEntries(c.fields.map((fl, i) => [fl.name, wrap(fieldSort(fl), { op: 'var', name: binds[i] })]));
             return { binds, out: f(fields) };
         });
         const first = built[0].out;
@@ -75,21 +84,34 @@ export function when(c, a, b) {
     const x = { op: 'if', c: c.y, then: ax, else: bx };
     return (a instanceof Val ? new Val(a.data, x) : new Nat(x));
 }
-// A datatype: its constructors, each with fields that are naturals or values of the datatype itself (`self`). Its
-// constructors are ordered as Lean's bijection numbers them: those of no field, then those with no field of the
-// datatype, then the rest; a datatype with no constructor of the first two kinds has no value and is refused.
+// A datatype: its constructors, each with fields that are naturals or values of a datatype (`self`, another of its group,
+// or one declared before it). Its constructors are ordered as Lean's bijection numbers them: those of no field, then
+// those with no field of its group, then the rest; a group with a datatype that has no value is refused.
+const declared = new Map();
+let declaredSeq = 0;
+export const dataNamed = (name) => { const d = declared.get(name); if (!d)
+    throw new Error(`no datatype ${name}`); return d; };
+// A field's sort; whether it is of the datatype's group (the fields its size counts, and an induction descends into).
+export const fieldSort = (f) => (f.sort === 'nat' ? 'nat' : dataNamed(f.sort.data));
+export const inGroup = (d, f) => f.sort !== 'nat' && d.group.includes(f.sort.data);
 export class Data {
     name;
+    group;
     ctors;
-    constructor(name, decl) {
+    seq = ++declaredSeq;
+    constructor(name, decl, group = [name]) {
         this.name = name;
-        const all = Object.entries(decl).map(([c, fs]) => ({ name: c, fields: Object.entries(fs).map(([f, s]) => ({ name: f, sort: s === self ? 'self' : 'nat' })) }));
-        const rank = (c) => (!c.fields.length ? 0 : c.fields.every(f => f.sort === 'nat') ? 1 : 2);
-        this.ctors = [...all].sort((a, b) => rank(a) - rank(b));
-        if (!this.ctors.some(c => rank(c) < 2))
-            throw new Error(`${name}: every constructor has a field of ${name}, so it has no value`);
+        this.group = group;
         if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
             throw new Error(`${name}: a datatype's name is letters and digits`);
+        const all = Object.entries(decl).map(([c, fs]) => ({ name: c, fields: Object.entries(fs).map(([f, s]) => ({ name: f, sort: s })) }));
+        for (const c of all)
+            for (const f of c.fields)
+                if (f.sort !== 'nat' && !group.includes(f.sort.data) && !declared.has(f.sort.data))
+                    throw new Error(`${name}.${c.name}.${f.name}: no datatype ${f.sort.data}`);
+        const rank = (c) => (!c.fields.length ? 0 : c.fields.every(f => !(f.sort !== 'nat' && group.includes(f.sort.data))) ? 1 : 2);
+        this.ctors = [...all].sort((a, b) => rank(a) - rank(b));
+        declared.set(name, this);
     }
     index(ctor) { const i = this.ctors.findIndex(c => c.name === ctor); if (i < 0)
         throw new Error(`${this.name} has no constructor ${ctor}`); return i; }
@@ -98,32 +120,111 @@ export class Data {
         const j = this.index(ctor), c = this.ctors[j];
         if (args.length !== c.fields.length)
             throw new Error(`${this.name}.${ctor} takes ${c.fields.length} fields`);
-        return new Val(this, { op: 'ctor', data: this.name, ctor: j, args: c.fields.map((f, i) => xOf(f.sort === 'nat' ? 'nat' : this, args[i])) });
+        return new Val(this, { op: 'ctor', data: this.name, ctor: j, args: c.fields.map((f, i) => xOf(fieldSort(f), args[i])) });
     }
+    // How many constructors deep its smallest value is (a constructor of no field of the group: 0), and each constructor's.
+    ctorHeight(c) { return c.fields.reduce((h, f) => (inGroup(this, f) ? Math.max(h, 1 + dataNamed(f.sort.data).height) : h), 0); }
+    get height() { return groupHeights(this.group).get(this.name); }
 }
-// `data('List', {nil: {}, cons: {head: nat, tail: self}})`: `List.nil`, `List.cons(h, t)`, and `xs.match({...})`.
+// The heights of a group's datatypes (least fixpoint; Infinity where a datatype has no value).
+function groupHeights(group) {
+    const h = new Map(group.map(n => [n, Infinity]));
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const n of group)
+            for (const c of dataNamed(n).ctors) {
+                const v = c.fields.reduce((m, f) => (f.sort !== 'nat' && group.includes(f.sort.data) ? Math.max(m, 1 + h.get(f.sort.data)) : m), 0);
+                if (v < h.get(n)) {
+                    h.set(n, v);
+                    changed = true;
+                }
+            }
+    }
+    return h;
+}
+// A group's checks: each datatype has a value, and Lean's decoding terminates (a datatype every constructor of which has
+// a field of the group and none of no field decodes n at fields up to n itself: those must not call each other in a ring).
+function checkGroup(ds) {
+    const hs = groupHeights(ds.map(d => d.name));
+    for (const d of ds)
+        if (hs.get(d.name) === Infinity)
+            throw new Error(`${d.name}: every constructor has a field of ${ds.length > 1 ? 'its group' : d.name} that has no value, so it has no value`);
+    void weakOrder(ds);
+}
+// A datatype is weak when its code n may be decoded at fields up to n (no constructor of no field, the first of the rest
+// with a field of the group); the order Lean's measure numbers them in (each weak one after the group's datatypes its
+// fields name), or a refusal.
+export function weakOrder(ds) {
+    const weak = (d) => d.nullary === 0 && d.ctors[0].fields.some(f => inGroup(d, f));
+    const out = new Map(), busy = new Set();
+    const visit = (d) => {
+        const had = out.get(d.name);
+        if (had !== undefined)
+            return had;
+        if (!weak(d)) {
+            out.set(d.name, 0);
+            return 0;
+        }
+        if (busy.has(d.name))
+            throw new Error(`${d.name}: its group's datatypes with no constructor of no field name each other in a ring, which the bijection with the naturals doesn't take`);
+        busy.add(d.name);
+        const o = 1 + Math.max(0, ...d.ctors.flatMap(c => c.fields.flatMap(f => (inGroup(d, f) && f.sort.data !== d.name ? [visit(dataNamed(f.sort.data))] : []))));
+        busy.delete(d.name);
+        if (d.ctors.some(c => c.fields.some(f => f.sort !== 'nat' && f.sort.data === d.name)) && weak(d))
+            throw new Error(`${d.name}: no constructor of no field and its first constructor has a field of ${d.name}, which the bijection with the naturals doesn't take`);
+        out.set(d.name, o);
+        return o;
+    };
+    ds.forEach(visit);
+    return out;
+}
+const normField = (own, group) => (s) => {
+    if (s === self)
+        return { data: own };
+    if (s === 'nat' || (s && typeof s === 'object' && 'nat' in s))
+        return 'nat';
+    if (s instanceof Data)
+        return { data: s.name };
+    if (typeof s === 'string' && group.includes(s))
+        return { data: s };
+    throw new Error(`${own}: a field is natural, self, a datatype declared before, or a name of its group`);
+};
+const withCtors = (d) => { for (const c of d.ctors)
+    Object.defineProperty(d, c.name, c.fields.length ? { value: (...args) => d.make(c.name, ...args) } : { get: () => d.make(c.name) }); };
+// `data('List', {nil: {}, cons: {head: natural, tail: self}})`: `List.nil`, `List.cons(h, t)`, and `xs.match({...})`. A
+// field may be a datatype declared before (`data('Bag', {none: {}, more: {items: List, rest: self}})`).
 export function data(name, decl) {
-    const norm = Object.fromEntries(Object.entries(decl).map(([c, fs]) => [c, Object.fromEntries(Object.entries(fs).map(([f, s]) => [f, s === self ? self : 'nat']))]));
-    const d = new Data(name, norm);
-    for (const c of d.ctors)
-        Object.defineProperty(d, c.name, c.fields.length ? { value: (...args) => d.make(c.name, ...args) } : { get: () => d.make(c.name) });
+    const d = new Data(name, Object.fromEntries(Object.entries(decl).map(([c, fs]) => [c, Object.fromEntries(Object.entries(fs).map(([f, s]) => [f, normField(name, [name])(s)]))])));
+    checkGroup([d]);
+    withCtors(d);
     return d;
 }
+// Datatypes declared together, each field naming one of the group by its name (a mutual pair: a rose tree and its
+// forest, `mutual({Rose: {node: {value: natural, kids: 'Forest'}}, Forest: {nil: {}, cons: {head: 'Rose', tail: 'Forest'}}})`).
+// oxlint-disable-next-line typescript/no-explicit-any
+export function mutual(decls) {
+    const group = Object.keys(decls);
+    const ds = group.map(n => new Data(n, Object.fromEntries(Object.entries(decls[n]).map(([c, fs]) => [c, Object.fromEntries(Object.entries(fs).map(([f, s]) => [f, normField(n, group)(s)]))])), group));
+    checkGroup(ds);
+    ds.forEach(withCtors);
+    return Object.fromEntries(ds.map(d => [d.name, d]));
+}
 const fns = new Map();
 export function define(name, params, ret, body) {
     if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
         throw new Error(`${name}: a function's name is letters and digits`);
     const ps = Object.entries(params).map(([n, s]) => ({ name: n, sort: s }));
-    let built;
+    let built, rec;
     const fn = { name, params: ps, ret, paramFns: [], body: () => {
             if (!built) {
                 const args = Object.fromEntries(ps.map(p => [p.name, wrap(p.sort, { op: 'var', name: `${name}.${p.name}` })]));
                 built = xOf(ret, body(args));
-                fn.decreases = decreasing(fn, built);
                 fn.paramFns = [...new Set(paramsIn(built))];
+                walk(built, o => { if (o.op === 'call' && !fns.has(o.fn))
+                    throw new Error(`${name} calls ${String(o.fn)}, which isn't defined`); });
             }
             return built;
-        } };
+        }, get decreases() { return (rec ??= recursion(fn)).decreases; }, get ring() { return (rec ??= recursion(fn)).ring; }, set rec(r) { rec = r; } };
     fns.set(name, fn);
     const call = (...args) => {
         if (args.length !== ps.length)
@@ -148,8 +249,8 @@ function walk(t, f) {
     for (const v of Object.values(o))
         walk(v, f);
 }
-// The parameter every recursive call passes a field of (bound by a match on that parameter), or a refusal.
-function decreasing(fn, body) {
+// The calls a body makes, each with what its bound names are fields of (a parameter, through matches).
+function callsIn(body) {
     const calls = [];
     const go = (x, fieldsOf) => {
         if (!x || typeof x !== 'object')
@@ -166,24 +267,63 @@ function decreasing(fn, body) {
                 c.binds.forEach(b => m.set(b, of)); go(c.body, m); });
             return;
         }
-        if (o.op === 'call' && o.fn === fn.name)
-            calls.push({ args: o.args, fieldsOf });
-        if (o.op === 'call' && o.fn !== fn.name && !fns.has(o.fn))
-            throw new Error(`${fn.name} calls ${o.fn}, which isn't defined`);
+        if (o.op === 'natmatch') {
+            go(o.of, fieldsOf);
+            go(o.zero, fieldsOf);
+            const of = o.of.op === 'var' ? (fieldsOf.get(o.of.name) ?? o.of.name) : undefined, m = new Map(fieldsOf);
+            if (of)
+                m.set(o.pred, of);
+            go(o.succ, m);
+            return;
+        }
+        if (o.op === 'call')
+            calls.push({ fn: o.fn, args: o.args, fieldsOf });
         for (const v of Object.values(o))
             go(v, fieldsOf);
     };
     go(body, new Map());
-    if (!calls.length)
-        return undefined;
-    for (const [i, p] of fn.params.entries()) {
-        if (p.sort === 'nat' || p.sort === 'bool')
-            continue;
-        const own = `${fn.name}.${p.name}`;
-        if (calls.every(c => { const a = c.args[i]; return a.op === 'var' && c.fieldsOf.get(a.name) === own; }))
-            return i;
+    return calls;
+}
+// A function's ring (the functions it calls that call it back, itself among them) and the parameter of each every call
+// within the ring passes a field of, or a refusal. Each of the ring is given its own.
+function recursion(fn) {
+    const callees = (f) => [...new Set(callsIn(f.body()).map(c => c.fn))];
+    const reach = (from) => { const seen = new Set(), todo = [from]; while (todo.length) {
+        const g = todo.pop();
+        for (const h of callees(fnOf(g)))
+            if (!seen.has(h)) {
+                seen.add(h);
+                todo.push(h);
+            }
+    } return seen; };
+    const mine = reach(fn.name);
+    const ring = [...mine].filter(g => g === fn.name || reach(g).has(fn.name));
+    if (!mine.has(fn.name)) {
+        fn.rec = { ring: [fn.name] };
+        return { ring: [fn.name] };
     }
-    throw new Error(`${fn.name}: not structural recursion (no parameter whose field every recursive call passes)`);
+    const members = [fn.name, ...ring.filter(g => g !== fn.name)].map(fnOf);
+    const options = members.map(f => f.params.flatMap((p, i) => (p.sort instanceof Data || p.sort === 'nat' ? [i] : [])));
+    const calls = members.map(f => callsIn(f.body()).filter(c => ring.includes(c.fn)));
+    // The first choice (by parameter order) every call within the ring meets.
+    const choose = (i, chosen) => {
+        if (i === members.length) {
+            const ok = members.every((f, a) => calls[a].every(c => { const b = members.findIndex(g => g.name === c.fn), arg = c.args[chosen[b]]; return arg.op === 'var' && c.fieldsOf.get(arg.name) === `${f.name}.${f.params[chosen[a]].name}`; }));
+            return ok ? chosen : undefined;
+        }
+        for (const o of options[i]) {
+            const r = choose(i + 1, [...chosen, o]);
+            if (r)
+                return r;
+        }
+        return undefined;
+    };
+    const got = choose(0, []);
+    if (!got)
+        throw new Error(`${fn.name}: not structural recursion (no parameter whose field every recursive call passes${members.length > 1 ? `, in its ring ${members.map(f => f.name).join(', ')}` : ''})`);
+    const names = members.map(f => f.name);
+    members.forEach((f, a) => { f.rec = { decreases: got[a], ring: names }; });
+    return { decreases: got[0], ring: names };
 }
 export function law(name, vars, holds) {
     const vs = Object.entries(vars).map(([n, s]) => ({ name: n, sort: s }));
@@ -211,6 +351,14 @@ export function evalX(x, env, params) {
         case 'bool': return evalY(x.c, env, params) ? 1 : 0;
         case 'apply': return params[x.param](asNat(evalX(x.arg, env, params)));
         case 'ctor': return { c: x.ctor, f: x.args.map(a => evalX(a, env, params)) };
+        case 'natmatch': {
+            const n = asNat(evalX(x.of, env, params));
+            if (n === 0)
+                return evalX(x.zero, env, params);
+            const e2 = new Map(env);
+            e2.set(x.pred, n - 1);
+            return evalX(x.succ, e2, params);
+        }
         case 'match': {
             const v = evalX(x.of, env, params), cs = x.cases[v.c];
             const e2 = new Map(env);
@@ -243,7 +391,7 @@ export const showValue = (d, v) => {
     if (d === 'nat' || d === 'bool')
         return JSON.stringify(v);
     const c = d.ctors[v.c];
-    return c.fields.length ? `${c.name}(${c.fields.map((f, i) => showValue(f.sort === 'nat' ? 'nat' : d, v.f[i])).join(', ')})` : c.name;
+    return c.fields.length ? `${c.name}(${c.fields.map((f, i) => showValue(fieldSort(f), v.f[i])).join(', ')})` : c.name;
 };
 export const rng = (seed) => () => { seed = (seed * 1103515245 + 12345) % 2147483648; return seed / 2147483648; };
 export function randomValue(s, rand, size, natMax = 5) {
@@ -251,11 +399,13 @@ export function randomValue(s, rand, size, natMax = 5) {
         return Math.floor(rand() * (natMax + 1));
     if (s === 'bool')
         return rand() < 0.5 ? 0 : 1;
-    const leaves = s.ctors.filter(c => c.fields.every(f => f.sort === 'nat'));
+    // The leaves: constructors of no field of the group, or (a datatype with none, a rose tree) those of least height.
+    const base = s.ctors.filter(c => c.fields.every(f => !inGroup(s, f)));
+    const leaves = base.length ? base : s.ctors.filter(c => s.ctorHeight(c) === s.height);
     const pick = size <= 0 || rand() < 0.25 ? leaves : s.ctors;
     const c = pick[Math.floor(rand() * pick.length)], j = s.ctors.indexOf(c);
-    const rec = c.fields.filter(f => f.sort === 'self').length;
-    return { c: j, f: c.fields.map(f => randomValue(f.sort === 'nat' ? 'nat' : s, rand, Math.floor((size - 1) / Math.max(1, rec)), natMax)) };
+    const rec = c.fields.filter(f => inGroup(s, f)).length;
+    return { c: j, f: c.fields.map(f => randomValue(fieldSort(f), rand, inGroup(s, f) ? Math.floor((size - 1) / Math.max(1, rec)) : Math.min(3, size), natMax)) };
 }
 // A random function of a natural: a table of small values.
 export const randomFn = (rand, natMax = 5) => { const t = new Map(); return n => { if (!t.has(n))
@@ -292,8 +442,13 @@ export const ctorMap = (d, j) => `${d.name}.${d.ctors[j].name}`;
 // Everything a law reads: the datatypes, the functions (with those they call), the function parameters.
 export function programOf(laws, extra = []) {
     const fs = new Map(), ds = new Map(), ps = new Set();
-    const addSort = (s) => { if (s instanceof Data)
-        ds.set(s.name, s); };
+    // A datatype with those its fields name (its group, those declared before it).
+    const addSort = (s) => { if (s instanceof Data && !ds.has(s.name)) {
+        ds.set(s.name, s);
+        for (const c of s.ctors)
+            for (const f of c.fields)
+                addSort(fieldSort(f));
+    } };
     const visit = (t) => walk(t, o => {
         if (o.op === 'call' && !fs.has(o.fn)) {
             const f = fnOf(o.fn);
@@ -311,7 +466,8 @@ export function programOf(laws, extra = []) {
     }
     for (const f of extra)
         visit({ op: 'call', fn: f.name, args: [] });
-    const datas = [...new Map([...ds.values()].map(d => [d.name, d])).values()];
+    // In order of declaration (each after those its fields name; a group together).
+    const datas = [...ds.values()].sort((a, b) => a.seq - b.seq);
     // Functions in definition order (each after those it calls).
     const order = [], seen = new Set();
     const place = (f) => { if (seen.has(f.name))
@@ -319,6 +475,9 @@ export function programOf(laws, extra = []) {
         place(fnOf(o.fn)); }); order.push(f); };
     for (const f of fs.values())
         place(f);
+    // (the recursion of each checked)
+    for (const f of order)
+        void f.decreases;
     return { datas, fns: order, params: [...ps] };
 }
 const dataOf = (p, name) => p.datas.find(d => d.name === name);
@@ -339,6 +498,11 @@ export function encX(p, x, env) {
             const d = dataOf(p, x.data);
             return x.args.length ? get(ctorMap(d, x.ctor), keyOf(x.args.map(a => encX(p, a, env)))) : k(x.ctor);
         }
+        case 'natmatch': {
+            const of = encX(p, x.of, env), e2 = new Map(env);
+            e2.set(x.pred, { op: 'sub', a: of, b: k(1) });
+            return { op: 'if', c: eqC(of, k(0)), then: encX(p, x.zero, env), else: encX(p, x.succ, e2) };
+        }
         case 'match': {
             const d = dataOf(p, x.data), of = encX(p, x.of, env);
             const bodies = x.cases.map((c, j) => { const e2 = new Map(env); c.binds.forEach((b, i) => e2.set(b, get(fieldMap(d, j, i), of))); return encX(p, c.body, e2); });
@@ -366,7 +530,7 @@ export function factsOf(p) {
         const tag = get(tagMap(d.name), x), size = (t) => get(sizeMap(d.name), t);
         // Under tag j: the size, and every field of another constructor 0 (what Lean's model reads there).
         const under = (c, j) => {
-            const sz = c.fields.flatMap((f, i) => (f.sort === 'self' ? [size(get(fieldMap(d, j, i), x))] : [])).reduce((a, b) => ({ op: 'add', a, b }), k(1));
+            const sz = c.fields.flatMap((f, i) => (inGroup(d, f) ? [get(sizeMap(f.sort.data), get(fieldMap(d, j, i), x))] : [])).reduce((a, b) => ({ op: 'add', a, b }), k(1));
             const others = d.ctors.flatMap((c2, j2) => (j2 === j ? [] : c2.fields.map((_, i2) => eqC(get(fieldMap(d, j2, i2), x), k(0)))));
             return andC(eqC(size(x), sz), ...others);
         };
@@ -420,14 +584,14 @@ export function decode(d, n) {
     if (n < z)
         return { c: n, f: [] };
     const q = Math.floor((n - z) / m), j = z + ((n - z) % m), c = d.ctors[j];
-    return { c: j, f: c.fields.map((f, i) => { const x = tup(q, c.fields.length, i); return f.sort === 'nat' ? x : decode(d, x); }) };
+    return { c: j, f: c.fields.map((f, i) => { const x = tup(q, c.fields.length, i); return f.sort === 'nat' ? x : decode(dataNamed(f.sort.data), x); }) };
 }
 export function encode(d, v) {
     const o = v, z = d.nullary, m = d.ctors.length - z;
     if (o.c < z)
         return o.c;
     const c = d.ctors[o.c];
-    return safe(z + m * tupk(c.fields.map((f, i) => (f.sort === 'nat' ? o.f[i] : encode(d, o.f[i])))) + (o.c - z));
+    return safe(z + m * tupk(c.fields.map((f, i) => (f.sort === 'nat' ? o.f[i] : encode(dataNamed(f.sort.data), o.f[i])))) + (o.c - z));
 }
 // Each map of the encoding as a function of its arguments, on the codes (for core/cycles.ts's runs).
 export function codeValues(p) {
@@ -436,9 +600,9 @@ export function codeValues(p) {
         out[tagMap(d.name)] = n => decode(d, n).c;
         out[sizeMap(d.name)] = n => sizeOf(d, decode(d, n));
         d.ctors.forEach((c, j) => {
-            c.fields.forEach((f, i) => { out[fieldMap(d, j, i)] = n => { const v = decode(d, n); return v.c === j ? (f.sort === 'nat' ? v.f[i] : encode(d, v.f[i])) : 0; }; });
+            c.fields.forEach((f, i) => { out[fieldMap(d, j, i)] = n => { const v = decode(d, n); return v.c === j ? (f.sort === 'nat' ? v.f[i] : encode(dataNamed(f.sort.data), v.f[i])) : 0; }; });
             if (c.fields.length)
-                out[ctorMap(d, j)] = (...xs) => encode(d, { c: j, f: c.fields.map((f, i) => (f.sort === 'nat' ? xs[i] : decode(d, xs[i]))) });
+                out[ctorMap(d, j)] = (...xs) => encode(d, { c: j, f: c.fields.map((f, i) => (f.sort === 'nat' ? xs[i] : decode(dataNamed(f.sort.data), xs[i]))) });
         });
     }
     for (const f of p.fns)
@@ -449,7 +613,7 @@ export function codeValues(p) {
     return out;
 }
 // That a value's fields of its datatype have smaller codes (true of the codes above: each field at most q).
-export const orderFacts = (p) => p.datas.map(d => ({ name: `order ${d.name}`, keys: ['x$'], holds: andC(yesC, ...d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort === 'self' ? [implies(eqC(get(tagMap(d.name), ev('x$')), k(j)), { op: '<', a: get(fieldMap(d, j, i), ev('x$')), b: ev('x$') })] : [])))) }));
+export const orderFacts = (p) => p.datas.map(d => ({ name: `order ${d.name}`, keys: ['x$'], holds: andC(yesC, ...d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort !== 'nat' && f.sort.data === d.name ? [implies(eqC(get(tagMap(d.name), ev('x$')), k(j)), { op: '<', a: get(fieldMap(d, j, i), ev('x$')), b: ev('x$') })] : [])))) }));
 // --- concrete models: a value of the encoding at random values (which terms are equal, for congruences and matches) ----
 // Values interned per datatype: a constructor of no field is its tag; the rest numbered from there. A key is a
 // pairing's natural, read back through its square root.
@@ -513,11 +677,11 @@ export class Model {
                 for (const [i, f] of c.fields.entries())
                     if (map === fieldMap(d, j, i)) {
                         const v = this.value(d, key);
-                        return v.c === j ? this.code(f.sort === 'nat' ? 'nat' : d, v.f[i]) : 0;
+                        return v.c === j ? this.code(fieldSort(f), v.f[i]) : 0;
                     }
                 if (c.fields.length && map === ctorMap(d, j)) {
                     const as = unkey(key, c.fields.length);
-                    return this.id(d, { c: j, f: c.fields.map((f, i) => this.decode(f.sort === 'nat' ? 'nat' : d, as[i])) });
+                    return this.id(d, { c: j, f: c.fields.map((f, i) => this.decode(fieldSort(f), as[i])) });
                 }
             }
         }
@@ -576,7 +740,7 @@ export class Model {
         }
     }
 }
-export const sizeOf = (d, v) => { const o = v; return 1 + d.ctors[o.c].fields.reduce((s, f, i) => s + (f.sort === 'self' ? sizeOf(d, o.f[i]) : 0), 0); };
+export const sizeOf = (d, v) => { const o = v; return 1 + d.ctors[o.c].fields.reduce((s, f, i) => s + (inGroup(d, f) ? sizeOf(fieldSort(f), o.f[i]) : 0), 0); };
 const isqrt = (n) => { let s = Math.floor(Math.sqrt(n)); while (s * s > n)
     s--; while ((s + 1) * (s + 1) <= n)
     s++; return s; };
@@ -601,6 +765,126 @@ export function refute(l, n = 400, seed = 7) {
     }
     return undefined;
 }
+// The function a function f calls at its decreasing argument's field of datatype `to` (a rose tree's sum, at its forest:
+// the forest's sum): the call, the same for every such field, its other arguments f's own parameters or closed terms.
+function partner(f, to) {
+    const di = f.decreases;
+    if (di === undefined)
+        return undefined;
+    const own = `${f.name}.${f.params[di].name}`, found = new Map();
+    let bad = false;
+    const go = (x, fields) => {
+        if (!x || typeof x !== 'object')
+            return;
+        if (Array.isArray(x)) {
+            x.forEach(y => go(y, fields));
+            return;
+        }
+        const t = x;
+        if (t.op === 'match' && t.of.op === 'var' && t.of.name === own) {
+            const d = dataNamed(t.data);
+            t.cases.forEach((c, j) => go(c.body, new Set([...fields, ...c.binds.filter((_, i) => { const fl = d.ctors[j].fields[i]; return fl.sort !== 'nat' && fl.sort.data === to.name; })])));
+            return;
+        }
+        if (t.op === 'call') {
+            const g = fnOf(t.fn), gd = g.decreases, at = gd === undefined ? undefined : t.args[gd];
+            if (at?.op === 'var' && fields.has(at.name)) {
+                const args = t.args.map((a, i) => (i === gd ? -1 : a.op === 'var' && a.name.startsWith(`${f.name}.`) ? f.params.findIndex(q => `${f.name}.${q.name}` === a.name) : !JSON.stringify(a).includes('"op":"var"') ? a : undefined));
+                if (args.some(a => a === undefined))
+                    bad = true;
+                else
+                    found.set(JSON.stringify([g.name, args]), { fn: g, args: args });
+            }
+        }
+        for (const v of Object.values(t))
+            go(v, fields);
+    };
+    go(f.body(), new Set());
+    return !bad && found.size === 1 ? [...found.values()][0] : undefined;
+}
+// The law said of a value of datatype `to` in place of v: v a variable of `to`, and each call whose decreasing argument
+// is then of `to` (no longer of its own datatype) its function's partner at `to`; none where a sort no longer fits (an
+// argument, a comparison).
+function companionOf(l, v, to, name) {
+    // (a sort unknown, an if's or a match's, fits any)
+    const sorts = new Map(l.vars.map(x => [x.name, x.sort])), same = (a, b) => a === undefined || b === undefined || (a instanceof Data ? a.name : a) === (b instanceof Data ? b.name : b);
+    const sortOf = (x, renamed) => (x.op === 'var' ? (renamed && x.name === name ? to : sorts.get(x.name)) : x.op === 'call' ? fnOf(x.fn).ret : x.op === 'ctor' ? dataNamed(x.data) : x.op === 'match' || x.op === 'if' ? undefined : 'nat');
+    let ok = true;
+    const lift = (t) => {
+        if (!ok)
+            return t;
+        if (Array.isArray(t))
+            return t.map(lift);
+        if (!t || typeof t !== 'object')
+            return t;
+        const o = t;
+        if (o.op === 'var' && o.name === v)
+            return { op: 'var', name };
+        if (o.op === 'call') {
+            const f = fnOf(o.fn), di = f.decreases, as = o.args.map(a => lift(a));
+            if (di !== undefined && !same(sortOf(as[di], true), sortOf(o.args[di], false))) {
+                const pt = partner(f, to);
+                if (!pt || !same(sortOf(as[di], true), to)) {
+                    ok = false;
+                    return o;
+                }
+                const args = pt.args.map(a => (a === -1 ? as[di] : typeof a === 'number' ? as[a] : a));
+                if (args.some((a, i) => i !== pt.fn.decreases && !same(sortOf(a, true), pt.fn.params[i].sort))) {
+                    ok = false;
+                    return o;
+                }
+                return { op: 'call', fn: pt.fn.name, args };
+            }
+            if (as.some((a, i) => !same(sortOf(a, true), f.params[i].sort))) {
+                ok = false;
+                return o;
+            }
+            return { ...o, args: as };
+        }
+        if (o.op === 'ctor') {
+            const d = dataNamed(o.data), as = o.args.map(a => lift(a));
+            if (as.some((a, i) => !same(sortOf(a, true), fieldSort(d.ctors[o.ctor].fields[i]))))
+                ok = false;
+            return { ...o, args: as };
+        }
+        const out = Object.fromEntries(Object.entries(o).map(([key, x]) => [key, lift(x)]));
+        if (out.op === '=' && !same(sortOf(out.a, true), sortOf(out.b, true)))
+            ok = false;
+        const om = o;
+        if (om.op === 'match' && !same(sortOf(out.of, true), dataNamed(om.data)))
+            ok = false;
+        return out;
+    };
+    const holds = lift(l.holds);
+    if (!ok || !JSON.stringify(holds).includes(JSON.stringify({ op: 'var', name })))
+        return undefined;
+    return { name: `${l.name}, at ${to.name}`, vars: l.vars.map(x => (x.name === v ? { name, sort: to } : x)), holds, params: l.params };
+}
+// The mutual scheme on v: the companions of the datatypes v's fields reach (through the group), or none.
+function mutualScheme(l, v, d) {
+    const at = new Map([[d.name, { law: l, v }]]), todo = [d];
+    while (todo.length) {
+        const x = todo.shift(), from = at.get(x.name);
+        for (const c of x.ctors)
+            for (const f of c.fields) {
+                if (!inGroup(x, f) || at.has(f.sort.data))
+                    continue;
+                const to = dataNamed(f.sort.data), name = `${v}${to.name}`, law = companionOf(from.law, from.v, to, name);
+                if (!law)
+                    return undefined;
+                at.set(to.name, { law, v: name });
+                todo.push(to);
+            }
+    }
+    if (at.size < 2)
+        return undefined;
+    const order = [...at.keys()];
+    const usesOf = (x, xv) => x.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (inGroup(x, f) && at.has(f.sort.data)
+        ? [{ subst: { [at.get(f.sort.data).v]: get(fieldMap(x, j, i), ev(xv)) }, guard: eqC(get(tagMap(x.name), ev(xv)), k(j)), member: order.indexOf(f.sort.data) }] : [])));
+    return { name: `mutual structure of ${v}`, on: { v, d }, uses: usesOf(d, v), companions: order.slice(1).map(n => { const x = dataNamed(n), a = at.get(n); return { law: a.law, on: { v: a.v, d: x }, uses: usesOf(x, a.v) }; }) };
+}
+// The inductions the search tries for a law (its schemes), for tests.
+export const schemesOf = (p, l) => schemes(p, l);
 function schemes(p, l) {
     const out = [], seen = new Set();
     const add = (s) => { const id = JSON.stringify(s.uses); if (!seen.has(id)) {
@@ -636,6 +920,14 @@ function schemes(p, l) {
                 t.cases.forEach((c, j) => { const e2 = new Map(env); c.binds.forEach((b, i) => e2.set(b, get(fieldMap(dd, j, i), of))); go(c.body, e2, [...guard, eqC(get(tagMap(dd.name), of), k(j))]); });
                 return;
             }
+            if (t.op === 'natmatch') {
+                go(t.of, env, guard);
+                const of = encX(p, t.of, env), e2 = new Map(env);
+                go(t.zero, env, [...guard, eqC(of, k(0))]);
+                e2.set(t.pred, { op: 'sub', a: of, b: k(1) });
+                go(t.succ, e2, [...guard, { op: 'not', x: eqC(of, k(0)) }]);
+                return;
+            }
             if (t.op === 'call' && t.fn === f.name) {
                 const subst = {};
                 let ok = true;
@@ -660,18 +952,23 @@ function schemes(p, l) {
         if (uses.length)
             add({ name: `recursion of ${f.name} on ${at.name}`, on: { v: at.name, d }, uses });
     });
-    // Structural induction on each variable of a datatype, the others fixed.
+    // Structural induction on each variable of a datatype, the others fixed; mutual where its fields reach another of its
+    // group (the law and its companions), plain where they reach none or no companion is found.
     for (const v of l.vars) {
         if (!(v.sort instanceof Data))
             continue;
-        const d = v.sort, x = ev(v.name);
-        add({ name: `structure of ${v.name}`, on: { v: v.name, d }, uses: d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort === 'self' ? [{ subst: { [v.name]: get(fieldMap(d, j, i), x) }, guard: eqC(get(tagMap(d.name), x), k(j)) }] : []))) });
+        const d = v.sort, x = ev(v.name), mut = mutualScheme(l, v.name, d);
+        if (mut) {
+            out.push(mut);
+            continue;
+        }
+        add({ name: `structure of ${v.name}`, on: { v: v.name, d }, uses: d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort !== 'nat' && f.sort.data === d.name ? [{ subst: { [v.name]: get(fieldMap(d, j, i), x) }, guard: eqC(get(tagMap(d.name), x), k(j)) }] : []))) });
     }
     return out;
 }
 function instancesOf(p, fs, w) {
     // Past the attempt's time, what is found so far (the attempt then fails or proves with it).
-    const late = () => w.until !== undefined && performance.now() > w.until;
+    const late = () => w.until !== undefined && clock() > w.until;
     const tt = performance.now(), lap = (what) => { if (dataTrace)
         console.error(`[data]   instances: ${what} at ${Math.round(performance.now() - tt)} ms`); };
     const insts = [], seen = new Set();
@@ -841,7 +1138,10 @@ function instancesOf(p, fs, w) {
                 const as = argsOf(r.key, f.params.length);
                 if (!as)
                     continue;
-                const own = as[f.decreases], d = f.params[f.decreases].sort, root = cl.find(tid(own));
+                const d0 = f.params[f.decreases].sort;
+                if (!(d0 instanceof Data))
+                    continue;
+                const own = as[f.decreases], d = d0, root = cl.find(tid(own));
                 const built = (t) => (t.op === 'get' && d.ctors.some((c, j) => c.fields.length && t.map === ctorMap(d, j))) || (t.op === 'const' && t.value < d.nullary);
                 const cands = built(own) ? [own] : [...cl.terms.values()].filter(t => built(t) && cl.find(tid(t)) === root);
                 for (const t of cands) {
@@ -877,8 +1177,8 @@ function instancesOf(p, fs, w) {
                     if (c.fields.length && t.map === ctorMap(d, j))
                         return d;
                     for (const [i, fl] of c.fields.entries())
-                        if (fl.sort === 'self' && t.map === fieldMap(d, j, i))
-                            return d;
+                        if (fl.sort !== 'nat' && t.map === fieldMap(d, j, i))
+                            return dataNamed(fl.sort.data);
                 }
         }
         return undefined;
@@ -1163,11 +1463,10 @@ const dataTrace = !!globalThis.process?.env?.DATA_TRACE;
 // Debugging: every congruence a model's closure makes, not only those explanations use.
 const allCong = !!globalThis.process?.env?.DATA_ALLCONG;
 function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
-    const t0 = performance.now();
+    const t0 = clock();
     anchoredAt.clear();
     // A few models for the instances; the whole pool for the cases (a rare case gets its own models from it).
-    const models = pool.slice(0, 24), few = (ms) => ms.slice(0, 16);
-    const concl = encY(p, l.holds, new Map());
+    const few = (ms) => ms.slice(0, 16);
     const specs = [], where = new Map();
     for (const lm of lemmas) {
         const local = new Map();
@@ -1181,31 +1480,39 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
             specs.push({ ...n, uses: n.uses.map(u => ({ ...u, node: local.get(u.node) ?? u.node })) });
         });
     }
-    const me = specs.length, name = `${l.name}${scheme ? ` (${scheme.name})` : ''}`;
-    varSorts = new Map(l.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : [])));
-    const size = scheme?.on ? get(sizeMap(scheme.on.d.name), ev(scheme.on.v)) : k(0);
-    const rank = (sub) => [k(level), size, k(sub)];
-    const ih = (scheme?.uses ?? []).map(u => ({ node: me, subst: u.subst, guard: u.guard }));
-    const shapesAt = scheme?.on ? [ev(scheme.on.v)] : [];
-    const ihConcls = ih.map(u => substC(concl, { vars: u.subst, maps: {}, flags: {} }));
-    // Uses of the lemmas, where a lemma's largest read matches a read of this goal (unfolded), its key up to the equalities
-    // the unfolded definitions give (any branch); twice over, the uses' own conclusions read the second time.
-    const pre = instancesOf(p, fs, { roots: [concl], others: ihConcls, depth, shapesAt, etaAt: [], models: [], until: t0 + attemptMs.ms });
-    const lemmaUses = lemmaUsesFor(p, fs, lemmas.map(lm => ({ law: lm.law, node: where.get(lm.spec.name), concl: specs[where.get(lm.spec.name)].concl })), [concl, ihConcls], pre, models);
-    const uses = [...ih, ...lemmaUses];
-    if (dataTrace)
-        for (const u of lemmaUses)
-            console.error(`[data]   lemma use ${specs[u.node].name.slice(0, 40)} at ${Object.entries(u.subst).map(([x, t]) => `${x} := ${JSON.stringify(t).slice(0, 80)}`).join('; ')}`);
-    const useConcl = (u) => substC(u.node === me ? concl : specs[u.node].concl, { vars: u.subst, maps: {}, flags: {} });
-    // The lemmas' conclusions are unfolded like the law's (they are what the goal reads, said another way); the cycle's
-    // own uses only from depth 3.
-    const instsFor = (ms, us, every = false) => instancesOf(p, fs, { roots: [concl], others: us.map(useConcl), depth, shapesAt, etaAt: [...shapesAt, ...valuesCompared(p, l)], models: ms, every, until: t0 + attemptMs.ms });
-    const cases = scheme ? casesOf(p, pre.filter(q => fs.facts[q.fact].name.startsWith('fn ')).map(q => holdsAt(fs, q)), new Set(l.vars.map(v => v.name)), pool) : [];
-    if (cases.length <= 1) {
-        specs.push({ name, hyps: [], concl, rank: rank(0), insts: instsFor(models, uses), uses });
-    }
-    else {
-        specs.push({ name, hyps: [], concl, rank: rank(1), insts: [], uses: cases.map((c, i) => ({ node: me + 1 + i, subst: {}, guard: andC(yesC, ...c.lits) })) });
+    // The scheme's nodes: the law's, then each companion's (a mutual induction), each its own models. A use of member i
+    // reads node -1 - i until the nodes are placed.
+    const members = [{ law: l, on: scheme?.on, uses: scheme?.uses ?? [], pool }, ...(scheme?.companions ?? []).map(c => ({ ...c, pool: modelsFor(p, c.law, pool.length, 5) }))];
+    const concls = members.map(mb => encY(p, mb.law.holds, new Map()));
+    const base = specs.length, title = `${l.name}${scheme ? ` (${scheme.name})` : ''}`;
+    varSorts = new Map(members.flatMap(mb => mb.law.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : []))));
+    const lemmaNodes = lemmas.map(lm => ({ law: lm.law, node: where.get(lm.spec.name), concl: specs[where.get(lm.spec.name)].concl }));
+    const useConcl = (u) => substC(u.node < 0 ? concls[-1 - u.node] : specs[u.node].concl, { vars: u.subst, maps: {}, flags: {} });
+    const plans = [];
+    for (const [mi, mb] of members.entries()) {
+        const models = mb.pool.slice(0, 24), concl = concls[mi], name = mi === 0 ? title : `${title}, at ${mb.on.d.name}`;
+        const ih = mb.uses.map(u => ({ node: -1 - (u.member ?? mi), subst: u.subst, guard: u.guard }));
+        const shapesAt = mb.on && mb.on.d !== 'nat' ? [ev(mb.on.v)] : [];
+        const ihConcls = ih.map(useConcl);
+        // Uses of the lemmas, where a lemma's largest read matches a read of this goal (unfolded), its key up to the
+        // equalities the unfolded definitions give (any branch); twice over, the uses' own conclusions read the second time.
+        const pre = instancesOf(p, fs, { roots: [concl], others: ihConcls, depth, shapesAt, etaAt: [], models: [], until: t0 + attemptMs.ms });
+        const lemmaUses = lemmaUsesFor(p, fs, lemmaNodes, [concl, ihConcls], pre, models);
+        const uses = [...ih, ...lemmaUses];
+        if (dataTrace)
+            for (const u of lemmaUses)
+                console.error(`[data]   lemma use ${specs[u.node].name.slice(0, 40)} at ${Object.entries(u.subst).map(([x, t]) => `${x} := ${JSON.stringify(t).slice(0, 80)}`).join('; ')}`);
+        // The lemmas' conclusions are unfolded like the law's (they are what the goal reads, said another way); the cycle's
+        // own uses only from depth 3.
+        const instsFor = (ms, us, every = false) => instancesOf(p, fs, { roots: [concl], others: us.map(useConcl), depth, shapesAt, etaAt: [...shapesAt, ...valuesCompared(p, mb.law)], models: ms, every, until: t0 + attemptMs.ms });
+        const cases = scheme ? casesOf(p, pre.filter(q => fs.facts[q.fact].name.startsWith('fn ')).map(q => holdsAt(fs, q)), new Set(mb.law.vars.map(v => v.name)), mb.pool) : [];
+        if (cases.length <= 1) {
+            // One node: four uses of a lemma, twelve in all, the best first (as lemmaUsesFor ranks them).
+            const one = capUses(uses, 12);
+            plans.push([{ name, hyps: [], concl, sub: 0, insts: instsFor(models, one), uses: one }]);
+            continue;
+        }
+        const plan = [{ name, hyps: [], concl, sub: 1, insts: [], uses: [], cases: cases.map(c => andC(yesC, ...c.lits)) }];
         for (const [i, c] of cases.entries()) {
             // The uses whose guard some model of the case meets (all, for a case no model reaches).
             const holdsIn = (g) => !c.models || c.models.some(({ m, env }) => { try {
@@ -1221,26 +1528,40 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
             catch {
                 return false;
             } }); };
-            const us = uses.filter(u => holdsIn(u.guard) && applies(u));
+            const us = capUses(uses.filter(u => holdsIn(u.guard) && applies(u)));
             const ms = few(c.models ?? c.near ?? models);
-            specs.push({ name: `${name}, case ${i + 1}`, hyps: c.lits, concl, rank: rank(0), insts: reached(p, fs, instsFor(ms, us), [c.lits, concl, us.map(u => [u.guard, useConcl(u)]), shapesAt], ms), uses: us });
+            plan.push({ name: `${name}, case ${i + 1}`, hyps: c.lits, concl, sub: 0, insts: reached(p, fs, instsFor(ms, us), [c.lits, concl, us.map(u => [u.guard, useConcl(u)]), shapesAt], ms), uses: us });
         }
+        plans.push(plan);
+    }
+    // Placed: each member's node, then its cases; a main node with cases uses them, at rank (level, size, 1) above theirs.
+    const offsets = plans.map((_, i) => base + plans.slice(0, i).reduce((n, q) => n + q.length, 0));
+    for (const [mi, plan] of plans.entries()) {
+        const mb = members[mi], size = !mb.on ? k(0) : mb.on.d === 'nat' ? ev(mb.on.v) : get(sizeMap(mb.on.d.name), ev(mb.on.v));
+        for (const { sub, cases, ...n } of plan)
+            specs.push({ ...n, rank: [k(level), size, k(sub)], uses: cases ? cases.map((g, i) => ({ node: offsets[mi] + 1 + i, subst: {}, guard: g })) : n.uses.map(u => (u.node < 0 ? { ...u, node: offsets[-1 - u.node] } : u)) });
     }
+    const name = title;
     // Each attempt within its own time (a goal past it is left unknown, and the attempt fails).
     if (dataTrace)
-        console.error(`[data] @${Math.round(performance.now())} ${l.name} (${scheme?.name}) depth ${depth}, ${lemmas.length} lemmas: built in ${Math.round(performance.now() - t0)} ms, ${specs.length} nodes, ${specs.reduce((n, x) => n + x.insts.length, 0)} instances`);
-    if (performance.now() > t0 + attemptMs.ms)
-        return { verdict: { proven: false, checked: false, node: name, goal: name, stuck: 'unknown' }, specs };
+        console.error(`[data] @${Math.round(performance.now())} ${l.name} (${scheme?.name}) depth ${depth}, ${lemmas.length} lemmas: built in ${Math.round(clock() - t0)} ms (counted), ${specs.length} nodes, ${specs.reduce((n, x) => n + x.insts.length, 0)} instances`);
+    if (clock() > t0 + attemptMs.ms)
+        return { verdict: { proven: false, checked: false, node: name, goal: name, stuck: 'unknown' }, specs, main: base };
     const was = pairedKeys.skip;
     pairedKeys.skip = true;
     try {
-        return { verdict: withDeadline(t0 + attemptMs.ms, () => proveCyclic(fs.facts, specs)), specs };
+        return { verdict: withDeadline(t0 + attemptMs.ms, () => proveCyclic(fs.facts, specs)), specs, main: base };
     }
     finally {
         pairedKeys.skip = was;
     }
 }
 export const attemptMs = { ms: 8000 };
+// A datatype search's budgets count work, not wall time (kernel/prove.ts's `counted`: the solver's rows and each node's),
+// 300 units a millisecond: a search finds the same proof on any machine, at any load. On Modal (2 vCPU) the corpus's
+// searches do 50 to 263 units a millisecond (`runs/modal/cover/data3`, data-cal), so a budget lets each do at least the
+// work it did there in wall time.
+const dataRate = 300;
 // A case node's instances, those its models reach: from every read of its conclusion and its uses' (and their guards),
 // through each instance at a read reached (a function's at its call, a constructor's at its cell, a shape or eta at a
 // value whose tag is read), the reads of what it gives where the models take it (an if's taken branch, an implication's
@@ -1386,6 +1707,7 @@ function lemmaUsesFor(p, fs, lemmas, from, insts, models = []) {
         reads.push(o); });
     for (let round = 0; round < 2; round++) {
         const fresh = [];
+        const cands = [];
         // The newest lemma first (the one the law is tried again for).
         for (const lm of [...lemmas].reverse()) {
             if (round > 0 && out.some(u => u.node === lm.node))
@@ -1410,28 +1732,70 @@ function lemmaUsesFor(p, fs, lemmas, from, insts, models = []) {
                             continue;
                         // Where a model gives the lemma's arguments the goal read's (a match through every branch's classes may be none).
                         const there = pats.map(a => substE(a, { vars: sub, maps: {}, flags: {} }));
-                        if (models.length && !models.some(({ m, env }) => { try {
+                        const score = models.length ? models.filter(({ m, env }) => { try {
                             return there.every((a, q) => m.evalE(a, env) === m.evalE(args[q], env));
                         }
                         catch {
                             return false;
-                        } }))
+                        } }).length : 1;
+                        if (!score)
                             continue;
                         const k2 = JSON.stringify([lm.node, sub]);
-                        if (seen.has(k2) || out.length >= 12 || out.filter(u => u.node === lm.node).length >= 4)
+                        if (seen.has(k2))
                             continue;
                         seen.add(k2);
-                        out.push({ node: lm.node, subst: sub, guard: yesC });
-                        matchedAt.set(out.at(-1), { goal: t, lemma: substE(top, { vars: sub, maps: {}, flags: {} }) });
-                        walk(substC(lm.concl, { vars: sub, maps: {}, flags: {} }), o => { if (o.op === 'get')
-                            fresh.push(o); });
+                        const names = Object.keys(sub).sort();
+                        const fp = models.length ? JSON.stringify([lm.node, models.map(({ m, env }) => names.map(x => { try {
+                                return m.evalE(sub[x], env);
+                            }
+                            catch {
+                                return -1;
+                            } }))]) : k2;
+                        cands.push({ use: { node: lm.node, subst: sub, guard: yesC }, at: { goal: t, lemma: substE(top, { vars: sub, maps: {}, flags: {} }) }, score, fp, size: k2.length });
                     }
                 }
         }
+        // First, as found: four of a lemma, twelve in all (the next round reads their conclusions). Then the rest, best first
+        // (the most models, then the smallest terms), one of each set of values, up to `perLemma` of a lemma and `total` in
+        // all: a case node keeps those its models meet, `perCase` of a lemma (attempt's `applies`), so a use that holds in
+        // one case only (the insertion's other side) isn't crowded out by those found first.
+        const fps = new Set(), first = new Set();
+        const take = (c) => { fps.add(c.fp); out.push(c.use); matchedAt.set(c.use, c.at); };
+        for (const c of cands) {
+            if (out.length >= 12 || out.filter(u => u.node === c.use.node).length >= 4)
+                continue;
+            take(c);
+            first.add(c);
+            walk(substC(lemmas.find(lm => lm.node === c.use.node).concl, { vars: c.use.subst, maps: {}, flags: {} }), o => { if (o.op === 'get')
+                fresh.push(o); });
+        }
+        const rest = cands.filter(c => !first.has(c)).sort((a, b) => b.score - a.score || a.size - b.size);
+        for (const c of rest)
+            if (!fps.has(c.fp) && out.length < lemmaCaps.total && out.filter(u => u.node === c.use.node).length < lemmaCaps.perLemma)
+                take(c);
         reads = fresh;
     }
     return out;
 }
+// How many uses of lemmas a goal gets: the candidates kept (`perLemma` of each lemma, `total`), and of those a case node
+// keeps (`perCase` of each lemma, those its models meet).
+export const lemmaCaps = { perLemma: 8, total: 24, perCase: 4 };
+// A node's uses: the scheme's (the cycle's, read at nodes not yet placed) all, `perCase` of each lemma, `total` lemma
+// uses in all, in the order given.
+function capUses(uses, total = Infinity) {
+    const per = new Map();
+    let all = 0;
+    return uses.filter(u => {
+        if (u.node < 0)
+            return true;
+        const n = per.get(u.node) ?? 0;
+        if (n >= lemmaCaps.perCase || all >= total)
+            return false;
+        per.set(u.node, n + 1);
+        all++;
+        return true;
+    });
+}
 // The equalities a condition may give: those in a positive place (a conjunction's parts, a disjunction's disjuncts that
 // aren't negations, so an implication's conclusion and never its premise).
 function equalities(c) {
@@ -1459,13 +1823,13 @@ function proveWith(p, fs, l, lemmas, level, opts, until, per, depths) {
     const ss = opts.induction === false ? [undefined] : schemes(p, l);
     for (const depth of depths.filter(d => d <= (opts.depth ?? 3)))
         for (const s of ss) {
-            if (performance.now() > until)
+            if (clock() > until)
                 return { tried, last };
             tried++;
-            const { verdict, specs } = (attemptMs.ms = Math.min(per * (opts.patience ?? 1), until - performance.now()), attempt(p, fs, l, s, depth, lemmas, level, models));
+            const { verdict, specs, main } = (attemptMs.ms = Math.min(per * (opts.patience ?? 1), until - clock()), attempt(p, fs, l, s, depth, lemmas, level, models));
             last = verdict;
             if (verdict.proven && verdict.checked)
-                return { out: { law: l, spec: specs.find(n => n.name === specs[specs.length - 1].name.replace(/, case \d+$/, '')), nodes: specs }, verdict, scheme: s?.name, tried };
+                return { out: { law: l, spec: specs[main], nodes: specs }, verdict, scheme: s?.name, tried };
         }
     return { tried, last };
 }
@@ -1527,7 +1891,7 @@ export function conjectures(p, l, max = 24, maxSize = 6) {
                 addT({ x: { op: 'call', fn: f.name, args: args.map(a => a.x) }, sort: f.ret, size });
         for (const d of p.datas)
             d.ctors.forEach((c, j) => { if (c.fields.length)
-                for (const args of build(c.fields.map(f => (f.sort === 'nat' ? 'nat' : d)), size - 1))
+                for (const args of build(c.fields.map(f => fieldSort(f)), size - 1))
                     addT({ x: { op: 'ctor', data: d.name, ctor: j, args: args.map(a => a.x) }, sort: d, size }); });
         for (const [a2, b2] of build(['nat', 'nat'], size - 1))
             if (JSON.stringify(a2.x) <= JSON.stringify(b2.x))
@@ -1754,6 +2118,7 @@ export const showX = (x) => {
             return `${d}.${x.ctor}${x.args.length ? `(${x.args.map(showX).join(', ')})` : ''}`;
         }
         case 'match': return `match ${showX(x.of)}`;
+        case 'natmatch': return `match ${showX(x.of)}`;
     }
 };
 export const showY = (y) => {
@@ -1771,10 +2136,15 @@ export const showY = (y) => {
 // Prove a law over datatypes: refuted by a random value where one breaks it; else proven by a cycle the search finds,
 // with lemmas found from the values when the law alone isn't (`lemmas: false` turns that off; an array gives lemmas to
 // prove and use instead, which the corpus never does).
-export function proveData(l, opts = {}) {
-    const t0 = performance.now(), until = t0 + (opts.ms ?? 120_000);
+export function proveData(l, opts = {}) { return counted(dataRate, () => proveDataCounted(l, opts)); }
+function proveDataCounted(l, opts) {
+    const t0 = performance.now(), w0 = work.n, until = clock() + (opts.ms ?? 120_000);
     const p = programOf([l, ...(Array.isArray(opts.lemmas) ? opts.lemmas : [])]), fs = factsOf(p);
-    const done = (v) => ({ law: l.name, ...v, ms: Math.round(performance.now() - t0) });
+    const done = (v) => {
+        if (dataTrace)
+            console.error(`[data] ${l.name}: ${work.n - w0} units of work in ${Math.round(performance.now() - t0)} ms`);
+        return { law: l.name, ...v, ms: Math.round(performance.now() - t0) };
+    };
     const cex = refute(l, opts.samples ?? 400);
     if (cex)
         return done({ proven: false, checked: false, counterexample: cex, lemmas: [], tried: 0 });
@@ -1804,11 +2174,15 @@ export function proveData(l, opts = {}) {
         return ok(proveWith(p, fs, l, [], 1, opts, until, 20000, [2, 3]), []) ?? done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
     const cands = Array.isArray(opts.lemmas) ? opts.lemmas : conjectures(p, l);
     const p2 = programOf([l, ...cands]), fs2 = factsOf(p2);
-    const goalOf = (s) => {
-        const concl = encY(p2, l.holds, new Map()), ihc = (s?.uses ?? []).map(u => substC(concl, { vars: u.subst, maps: {}, flags: {} }));
-        return { from: [concl, ihc], insts: instancesOf(p2, fs2, { roots: [concl], others: ihc, depth: 2, shapesAt: s?.on ? [ev(s.on.v)] : [], etaAt: [], models: [] }) };
+    // Each scheme's goals: the law's, and each companion's (a lemma may be what only a companion's goal reads).
+    const goalOf = (law, uses, on, concls) => {
+        const concl = encY(p2, law.holds, new Map()), ihc = uses.map(u => substC(concls[u.member ?? 0] ?? concl, { vars: u.subst, maps: {}, flags: {} }));
+        return { from: [concl, ihc], insts: instancesOf(p2, fs2, { roots: [concl], others: ihc, depth: 2, shapesAt: on && on.d !== 'nat' ? [ev(on.v)] : [], etaAt: [], models: [] }) };
     };
-    const goals = schemes(p2, l).map(goalOf);
+    const goals = schemes(p2, l).flatMap(s => {
+        const all = [{ law: l, uses: s.uses, on: s.on }, ...(s.companions ?? [])], concls = all.map(m => encY(p2, m.law.holds, new Map()));
+        return all.map((m, i) => goalOf(m.law, m.uses.map(u => ({ ...u, member: u.member ?? i })), m.on, concls));
+    });
     const matchesGoal = (c) => goals.some(g => lemmaUsesFor(p2, fs2, [{ law: c, node: 0, concl: encY(p2, c.holds, new Map()) }], g.from, g.insts).length > 0);
     // Those the goal matches first, of those the ones of the law's shape (an implication for an implication) first.
     const implication = (y) => y.op === 'or' && y.xs.length === 2 && y.xs[0].op === 'not';
@@ -1817,11 +2191,11 @@ export function proveData(l, opts = {}) {
     const proven = [], failed = new Set();
     const lemmasAt = (depth) => {
         for (const { c, hit } of ranked) {
-            if (performance.now() > until)
+            if (clock() > until)
                 return undefined;
             if (proven.some(q => q.law === c) || (depth === 2 && !failed.has(c)) || refute(c, 200))
                 continue;
-            const r = proveWith(p2, fs2, c, proven, 1 + proven.length, opts, Math.min(until, performance.now() + (depth === 1 ? 8000 : 12000) * (opts.patience ?? 1)), 5000, [depth]);
+            const r = proveWith(p2, fs2, c, proven, 1 + proven.length, opts, Math.min(until, clock() + (depth === 1 ? 8000 : 12000) * (opts.patience ?? 1)), 5000, [depth]);
             tried += r.tried;
             if (!r.out) {
                 failed.add(c);
@@ -1845,7 +2219,7 @@ export function proveData(l, opts = {}) {
         () => ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 12000, [3]), proven, p2),
     ];
     for (const step of steps) {
-        if (performance.now() > until)
+        if (clock() > until)
             break;
         const out = step();
         if (out)