gdp-wired 0.19.0 → 0.21.0

package/dist/core/data.js

@@ -1,13 +1,22 @@
 import { substC, substE } from "../kernel/kernel.js";
 import { proveCyclic } from "./cyclic.js";
-import { pairedKeys, withDeadline } from "../kernel/prove.js";
+import { clock, counted, pairedKeys, withDeadline } from "../kernel/prove.js";
+import { work } from "./solver.js";
+import { ranksOfRuns } from "./cycles.js";
+import { proveThrough, transferPlan } from "./transfer.js";
 // --- sorts and the AST ------------------------------------------------------------------------------------------------
 export const self = { self: true };
 export const natural = 'nat';
 export const boolean = 'bool';
+// A signed integer (Lean's Int): opt-in, beside the naturals, whose truncated subtraction keeps its meaning. Encoded as
+// its zigzag code (z ↦ 2z for z ≥ 0, −2z − 1 below), a bijection with the naturals like a datatype's, so a value is one
+// natural and two values are equal exactly when their codes are; its arithmetic reads a code as two naturals, p − n
+// (from the code's quotient and remainder by 2), and writes the result's code back (`encI`, `codeOfPair`).
+export const integer = 'int';
+export const isDataField = (s) => typeof s === 'object';
 // --- the surface ------------------------------------------------------------------------------------------------------
 let fresh = 0;
-const bindName = (field) => `${field}#${++fresh}`;
+export const bindName = (field) => `${field}#${++fresh}`;
 export class Nat {
     x;
     constructor(x) {
@@ -16,14 +25,56 @@ export class Nat {
     plus(b) { return new Nat({ op: 'add', a: this.x, b: natX(b) }); }
     minus(b) { return new Nat({ op: 'sub', a: this.x, b: natX(b) }); }
     times(k) { return new Nat({ op: 'mul', k, a: this.x }); }
+    // A product of two naturals (the kernel multiplies it out; nonlinear: what proves it is products of facts and squares).
+    mul(b) { return new Nat({ op: 'prod', a: this.x, b: natX(b) }); }
+    modBy(k) { return new Nat({ op: 'mod', k: divisorOf(k), a: this.x }); }
+    divBy(k) { return new Nat({ op: 'div', k: divisorOf(k), a: this.x }); }
+    toInt() { return new Integer({ op: 'ofnat', a: this.x }); }
     lt(b) { return new Bool({ op: '<', a: this.x, b: natX(b) }); }
     atMost(b) { return new Bool({ op: '<=', a: this.x, b: natX(b) }); }
     gt(b) { return new Bool({ op: '<', a: natX(b), b: this.x }); }
     atLeast(b) { return new Bool({ op: '<=', a: natX(b), b: this.x }); }
     eq(b) { return new Bool({ op: '=', a: this.x, b: natX(b) }); }
     ne(b) { return this.eq(b).not(); }
+    // A natural as 0 or the successor of another (`pred`): recursion on a natural passes `pred` where this is a parameter.
+    // oxlint-disable-next-line typescript/no-explicit-any
+    match(cases) {
+        const pred = bindName('pred'), zero = cases.zero(), succ = cases.succ({ pred: new Nat({ op: 'var', name: pred }) });
+        const int = zero instanceof Integer || succ instanceof Integer;
+        const body = (o) => (typeof o === 'number' ? (int ? intX(o) : natX(o)) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
+        const x = { op: 'natmatch', of: this.x, zero: body(zero), pred, succ: body(succ) };
+        return (zero instanceof Bool ? new Bool({ op: 'holds', x }) : zero instanceof Val ? new Val(zero.data, x) : int ? new Integer(x) : new Nat(x));
+    }
 }
 const natX = (t) => (typeof t === 'number' ? { op: 'nat', value: t } : t.x);
+const divisorOf = (k) => { if (!Number.isSafeInteger(k) || k < 1)
+    throw new RangeError(`a divisor is a whole number at least 1, not ${k}`); return k; };
+// An integer's term; a number is a literal (any sign).
+export class Integer {
+    x;
+    constructor(x) {
+        this.x = x;
+    }
+    plus(b) { return new Integer({ op: 'iadd', a: this.x, b: intX(b) }); }
+    minus(b) { return new Integer({ op: 'isub', a: this.x, b: intX(b) }); }
+    negate() { return new Integer({ op: 'ineg', a: this.x }); }
+    times(k) { if (!Number.isSafeInteger(k))
+        throw new RangeError(`${k} is not an integer`); return new Integer({ op: 'imul', k, a: this.x }); }
+    modBy(k) { return new Integer({ op: 'imod', k: divisorOf(k), a: this.x }); }
+    divBy(k) { return new Integer({ op: 'idiv', k: divisorOf(k), a: this.x }); }
+    lt(b) { return new Bool({ op: 'i<', a: this.x, b: intX(b) }); }
+    atMost(b) { return new Bool({ op: 'i<=', a: this.x, b: intX(b) }); }
+    gt(b) { return new Bool({ op: 'i<', a: intX(b), b: this.x }); }
+    atLeast(b) { return new Bool({ op: 'i<=', a: intX(b), b: this.x }); }
+    eq(b) { return new Bool({ op: '=', a: this.x, b: intX(b) }); }
+    ne(b) { return this.eq(b).not(); }
+}
+// An integer function's result: a natural literal in a branch (a match's case, an if's arm) is the integer's.
+const intResult = (x) => (x.op === 'nat' ? { op: 'int', value: x.value } : x.op === 'if' ? { ...x, then: intResult(x.then), else: intResult(x.else) }
+    : x.op === 'match' ? { ...x, cases: x.cases.map(c => ({ ...c, body: intResult(c.body) })) } : x.op === 'natmatch' ? { ...x, zero: intResult(x.zero), succ: intResult(x.succ) } : x);
+const intX = (t) => { if (typeof t !== 'number')
+    return t.x; if (!Number.isSafeInteger(t))
+    throw new RangeError(`${t} is not an integer`); return { op: 'int', value: t }; };
 export class Bool {
     y;
     constructor(y) {
@@ -53,43 +104,61 @@ export class Val {
             if (!f)
                 throw new Error(`${d.name}: match has no case ${c.name}`);
             const binds = c.fields.map(fl => bindName(fl.name));
-            const fields = Object.fromEntries(c.fields.map((fl, i) => [fl.name, wrap(fl.sort === 'nat' ? 'nat' : d, { op: 'var', name: binds[i] })]));
+            const fields = Object.fromEntries(c.fields.map((fl, i) => [fl.name, wrap(fieldSort(fl), { op: 'var', name: binds[i] })]));
             return { binds, out: f(fields) };
         });
         const first = built[0].out;
-        const body = (o) => (typeof o === 'number' ? natX(o) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
+        // A case that is an integer makes every case's number an integer's literal.
+        const int = built.some(b => b.out instanceof Integer);
+        const body = (o) => (typeof o === 'number' ? (int ? intX(o) : natX(o)) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
         const x = { op: 'match', data: d.name, of: this.x, cases: built.map(b => ({ binds: b.binds, body: body(b.out) })) };
-        return (first instanceof Bool ? new Bool({ op: 'holds', x }) : first instanceof Val ? new Val(first.data, x) : new Nat(x));
+        return (first instanceof Bool ? new Bool({ op: 'holds', x }) : first instanceof Val ? new Val(first.data, x) : int ? new Integer(x) : new Nat(x));
     }
     is(ctor) { return new Bool({ op: 'is', data: this.data.name, of: this.x, ctor: this.data.index(ctor) }); }
+    // Its size: 1 plus the sizes of its fields of its datatype's group (a list's length plus 1, a tree's nodes and leaves).
+    size() { return new Nat({ op: 'size', data: this.data.name, of: this.x }); }
     eq(b) { return new Bool({ op: '=', a: this.x, b: b.x }); }
     ne(b) { return this.eq(b).not(); }
 }
 // A value of a sort from its term.
-export const wrap = (s, x) => (s === 'nat' ? new Nat(x) : s === 'bool' ? new Bool({ op: 'holds', x }) : new Val(s, x));
-const xOf = (s, v) => (s === 'nat' ? natX(v) : s === 'bool' ? { op: 'bool', c: v.y } : v.x);
+export const wrap = (s, x) => (s === 'nat' ? new Nat(x) : s === 'bool' ? new Bool({ op: 'holds', x }) : s === 'int' ? new Integer(x) : new Val(s, x));
+const xOf = (s, v) => (s === 'nat' ? natX(v) : s === 'bool' ? { op: 'bool', c: v.y } : s === 'int' ? intX(v) : v.x);
 export function when(c, a, b) {
     if (a instanceof Bool)
         return new Bool({ op: 'or', xs: [{ op: 'and', xs: [c.y, a.y] }, { op: 'and', xs: [{ op: 'not', x: c.y }, b.y] }] });
-    const ax = typeof a === 'number' ? natX(a) : a.x, bx = typeof b === 'number' ? natX(b) : b.x;
+    const int = a instanceof Integer || b instanceof Integer, lit = (t) => (int ? intX(t) : natX(t));
+    const ax = typeof a === 'number' ? lit(a) : a.x, bx = typeof b === 'number' ? lit(b) : b.x;
     const x = { op: 'if', c: c.y, then: ax, else: bx };
-    return (a instanceof Val ? new Val(a.data, x) : new Nat(x));
+    return (a instanceof Val ? new Val(a.data, x) : int ? new Integer(x) : new Nat(x));
 }
-// A datatype: its constructors, each with fields that are naturals or values of the datatype itself (`self`). Its
-// constructors are ordered as Lean's bijection numbers them: those of no field, then those with no field of the
-// datatype, then the rest; a datatype with no constructor of the first two kinds has no value and is refused.
+// A datatype: its constructors, each with fields that are naturals or values of a datatype (`self`, another of its group,
+// or one declared before it). Its constructors are ordered as Lean's bijection numbers them: those of no field, then
+// those with no field of its group, then the rest; a group with a datatype that has no value is refused.
+const declared = new Map();
+let declaredSeq = 0;
+export const dataNamed = (name) => { const d = declared.get(name); if (!d)
+    throw new Error(`no datatype ${name}`); return d; };
+// A field's sort; whether it is of the datatype's group (the fields its size counts, and an induction descends into).
+export const fieldSort = (f) => (f.sort === 'nat' || f.sort === 'int' ? f.sort : dataNamed(f.sort.data));
+export const inGroup = (d, f) => isDataField(f.sort) && d.group.includes(f.sort.data);
 export class Data {
     name;
+    group;
     ctors;
-    constructor(name, decl) {
+    seq = ++declaredSeq;
+    constructor(name, decl, group = [name]) {
         this.name = name;
-        const all = Object.entries(decl).map(([c, fs]) => ({ name: c, fields: Object.entries(fs).map(([f, s]) => ({ name: f, sort: s === self ? 'self' : 'nat' })) }));
-        const rank = (c) => (!c.fields.length ? 0 : c.fields.every(f => f.sort === 'nat') ? 1 : 2);
-        this.ctors = [...all].sort((a, b) => rank(a) - rank(b));
-        if (!this.ctors.some(c => rank(c) < 2))
-            throw new Error(`${name}: every constructor has a field of ${name}, so it has no value`);
+        this.group = group;
         if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
             throw new Error(`${name}: a datatype's name is letters and digits`);
+        const all = Object.entries(decl).map(([c, fs]) => ({ name: c, fields: Object.entries(fs).map(([f, s]) => ({ name: f, sort: s })) }));
+        for (const c of all)
+            for (const f of c.fields)
+                if (isDataField(f.sort) && !group.includes(f.sort.data) && !declared.has(f.sort.data))
+                    throw new Error(`${name}.${c.name}.${f.name}: no datatype ${f.sort.data}`);
+        const rank = (c) => (!c.fields.length ? 0 : c.fields.every(f => !(isDataField(f.sort) && group.includes(f.sort.data))) ? 1 : 2);
+        this.ctors = [...all].sort((a, b) => rank(a) - rank(b));
+        declared.set(name, this);
     }
     index(ctor) { const i = this.ctors.findIndex(c => c.name === ctor); if (i < 0)
         throw new Error(`${this.name} has no constructor ${ctor}`); return i; }
@@ -98,32 +167,127 @@ export class Data {
         const j = this.index(ctor), c = this.ctors[j];
         if (args.length !== c.fields.length)
             throw new Error(`${this.name}.${ctor} takes ${c.fields.length} fields`);
-        return new Val(this, { op: 'ctor', data: this.name, ctor: j, args: c.fields.map((f, i) => xOf(f.sort === 'nat' ? 'nat' : this, args[i])) });
+        return new Val(this, { op: 'ctor', data: this.name, ctor: j, args: c.fields.map((f, i) => xOf(fieldSort(f), args[i])) });
+    }
+    // How many constructors deep its smallest value is (a constructor of no field of the group: 0), and each constructor's.
+    ctorHeight(c) { return c.fields.reduce((h, f) => (inGroup(this, f) ? Math.max(h, 1 + dataNamed(f.sort.data).height) : h), 0); }
+    get height() { return groupHeights(this.group).get(this.name); }
+}
+// The heights of a group's datatypes (least fixpoint; Infinity where a datatype has no value).
+function groupHeights(group) {
+    const h = new Map(group.map(n => [n, Infinity]));
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const n of group)
+            for (const c of dataNamed(n).ctors) {
+                const v = c.fields.reduce((m, f) => (isDataField(f.sort) && group.includes(f.sort.data) ? Math.max(m, 1 + h.get(f.sort.data)) : m), 0);
+                if (v < h.get(n)) {
+                    h.set(n, v);
+                    changed = true;
+                }
+            }
     }
+    return h;
+}
+// A group's checks: each datatype has a value, and Lean's decoding terminates (a datatype every constructor of which has
+// a field of the group and none of no field decodes n at fields up to n itself: those must not call each other in a ring).
+function checkGroup(ds) {
+    const hs = groupHeights(ds.map(d => d.name));
+    for (const d of ds)
+        if (hs.get(d.name) === Infinity)
+            throw new Error(`${d.name}: every constructor has a field of ${ds.length > 1 ? 'its group' : d.name} that has no value, so it has no value`);
+    void weakOrder(ds);
+}
+// A datatype is weak when its code n may be decoded at fields up to n (no constructor of no field, the first of the rest
+// with a field of the group); the order Lean's measure numbers them in (each weak one after the group's datatypes its
+// fields name), or a refusal.
+export function weakOrder(ds) {
+    const weak = (d) => d.nullary === 0 && d.ctors[0].fields.some(f => inGroup(d, f));
+    const out = new Map(), busy = new Set();
+    const visit = (d) => {
+        const had = out.get(d.name);
+        if (had !== undefined)
+            return had;
+        if (!weak(d)) {
+            out.set(d.name, 0);
+            return 0;
+        }
+        if (busy.has(d.name))
+            throw new Error(`${d.name}: its group's datatypes with no constructor of no field name each other in a ring, which the bijection with the naturals doesn't take`);
+        busy.add(d.name);
+        const o = 1 + Math.max(0, ...d.ctors.flatMap(c => c.fields.flatMap(f => (inGroup(d, f) && f.sort.data !== d.name ? [visit(dataNamed(f.sort.data))] : []))));
+        busy.delete(d.name);
+        if (d.ctors.some(c => c.fields.some(f => isDataField(f.sort) && f.sort.data === d.name)) && weak(d))
+            throw new Error(`${d.name}: no constructor of no field and its first constructor has a field of ${d.name}, which the bijection with the naturals doesn't take`);
+        out.set(d.name, o);
+        return o;
+    };
+    ds.forEach(visit);
+    return out;
 }
-// `data('List', {nil: {}, cons: {head: nat, tail: self}})`: `List.nil`, `List.cons(h, t)`, and `xs.match({...})`.
+const normField = (own, group) => (s) => {
+    if (s === self)
+        return { data: own };
+    if (s === 'nat' || (s && typeof s === 'object' && 'nat' in s))
+        return 'nat';
+    if (s === 'int')
+        return 'int';
+    if (s instanceof Data)
+        return { data: s.name };
+    if (typeof s === 'string' && group.includes(s))
+        return { data: s };
+    throw new Error(`${own}: a field is natural, integer, self, a datatype declared before, or a name of its group`);
+};
+const withCtors = (d) => { for (const c of d.ctors)
+    Object.defineProperty(d, c.name, c.fields.length ? { value: (...args) => d.make(c.name, ...args) } : { get: () => d.make(c.name) }); };
+// `data('List', {nil: {}, cons: {head: natural, tail: self}})`: `List.nil`, `List.cons(h, t)`, and `xs.match({...})`. A
+// field may be a datatype declared before (`data('Bag', {none: {}, more: {items: List, rest: self}})`).
 export function data(name, decl) {
-    const norm = Object.fromEntries(Object.entries(decl).map(([c, fs]) => [c, Object.fromEntries(Object.entries(fs).map(([f, s]) => [f, s === self ? self : 'nat']))]));
-    const d = new Data(name, norm);
-    for (const c of d.ctors)
-        Object.defineProperty(d, c.name, c.fields.length ? { value: (...args) => d.make(c.name, ...args) } : { get: () => d.make(c.name) });
+    const d = new Data(name, Object.fromEntries(Object.entries(decl).map(([c, fs]) => [c, Object.fromEntries(Object.entries(fs).map(([f, s]) => [f, normField(name, [name])(s)]))])));
+    checkGroup([d]);
+    withCtors(d);
     return d;
 }
+// Datatypes declared together, each field naming one of the group by its name (a mutual pair: a rose tree and its
+// forest, `mutual({Rose: {node: {value: natural, kids: 'Forest'}}, Forest: {nil: {}, cons: {head: 'Rose', tail: 'Forest'}}})`).
+// oxlint-disable-next-line typescript/no-explicit-any
+export function mutual(decls) {
+    const group = Object.keys(decls);
+    const ds = group.map(n => new Data(n, Object.fromEntries(Object.entries(decls[n]).map(([c, fs]) => [c, Object.fromEntries(Object.entries(fs).map(([f, s]) => [f, normField(n, group)(s)]))])), group));
+    checkGroup(ds);
+    ds.forEach(withCtors);
+    return Object.fromEntries(ds.map(d => [d.name, d]));
+}
 const fns = new Map();
-export function define(name, params, ret, body) {
+export function define(name, params, ret, body, opts = {}) {
     if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
         throw new Error(`${name}: a function's name is letters and digits`);
     const ps = Object.entries(params).map(([n, s]) => ({ name: n, sort: s }));
-    let built;
-    const fn = { name, params: ps, ret, paramFns: [], body: () => {
+    const stated = opts.measure && measureOf(name, ps, opts.measure);
+    let built, rec, failed;
+    // The recursion, checked once (a refusal kept and given again).
+    const got = () => {
+        if (failed)
+            throw failed;
+        try {
+            return (rec ??= recursion(fn));
+        }
+        catch (e) {
+            failed = e;
+            throw e;
+        }
+    };
+    const fn = { name, params: ps, ret, paramFns: [], stated, body: () => {
             if (!built) {
                 const args = Object.fromEntries(ps.map(p => [p.name, wrap(p.sort, { op: 'var', name: `${name}.${p.name}` })]));
-                built = xOf(ret, body(args));
-                fn.decreases = decreasing(fn, built);
+                built = ret === 'int' ? intResult(xOf(ret, body(args))) : xOf(ret, body(args));
                 fn.paramFns = [...new Set(paramsIn(built))];
+                walk(built, o => { if (o.op === 'call' && !fns.has(o.fn))
+                    throw new Error(`${name} calls ${String(o.fn)}, which isn't defined`); });
             }
             return built;
-        } };
+        }, get decreases() { return got().decreases; }, get ring() { return got().ring; }, get measure() { return got().measure; }, get termination() { return got().termination; },
+        set rec(r) { rec = r; } };
     fns.set(name, fn);
     const call = (...args) => {
         if (args.length !== ps.length)
@@ -148,8 +312,8 @@ function walk(t, f) {
     for (const v of Object.values(o))
         walk(v, f);
 }
-// The parameter every recursive call passes a field of (bound by a match on that parameter), or a refusal.
-function decreasing(fn, body) {
+// The calls a body makes, each with what its bound names are fields of (a parameter, through matches).
+function callsIn(body) {
     const calls = [];
     const go = (x, fieldsOf) => {
         if (!x || typeof x !== 'object')
@@ -166,24 +330,368 @@ function decreasing(fn, body) {
                 c.binds.forEach(b => m.set(b, of)); go(c.body, m); });
             return;
         }
-        if (o.op === 'call' && o.fn === fn.name)
-            calls.push({ args: o.args, fieldsOf });
-        if (o.op === 'call' && o.fn !== fn.name && !fns.has(o.fn))
-            throw new Error(`${fn.name} calls ${o.fn}, which isn't defined`);
+        if (o.op === 'natmatch') {
+            go(o.of, fieldsOf);
+            go(o.zero, fieldsOf);
+            const of = o.of.op === 'var' ? (fieldsOf.get(o.of.name) ?? o.of.name) : undefined, m = new Map(fieldsOf);
+            if (of)
+                m.set(o.pred, of);
+            go(o.succ, m);
+            return;
+        }
+        if (o.op === 'call')
+            calls.push({ fn: o.fn, args: o.args, fieldsOf });
         for (const v of Object.values(o))
             go(v, fieldsOf);
     };
     go(body, new Map());
-    if (!calls.length)
+    return calls;
+}
+// A function's ring (the functions it calls that call it back, itself among them) and the parameter of each every call
+// within the ring passes a field of, or a refusal. Each of the ring is given its own.
+function recursion(fn) {
+    const callees = (f) => [...new Set(callsIn(f.body()).map(c => c.fn))];
+    const reach = (from) => { const seen = new Set(), todo = [from]; while (todo.length) {
+        const g = todo.pop();
+        for (const h of callees(fnOf(g)))
+            if (!seen.has(h)) {
+                seen.add(h);
+                todo.push(h);
+            }
+    } return seen; };
+    const mine = reach(fn.name);
+    const ring = [...mine].filter(g => g === fn.name || reach(g).has(fn.name));
+    if (!mine.has(fn.name)) {
+        fn.rec = { ring: [fn.name] };
+        return { ring: [fn.name] };
+    }
+    const members = [fn.name, ...ring.filter(g => g !== fn.name)].map(fnOf);
+    const options = members.map(f => f.params.flatMap((p, i) => (p.sort instanceof Data || p.sort === 'nat' ? [i] : [])));
+    const calls = members.map(f => callsIn(f.body()).filter(c => ring.includes(c.fn)));
+    // The first choice (by parameter order) every call within the ring meets.
+    const choose = (i, chosen) => {
+        if (i === members.length) {
+            const ok = members.every((f, a) => calls[a].every(c => { const b = members.findIndex(g => g.name === c.fn), arg = c.args[chosen[b]]; return arg.op === 'var' && c.fieldsOf.get(arg.name) === `${f.name}.${f.params[chosen[a]].name}`; }));
+            return ok ? chosen : undefined;
+        }
+        for (const o of options[i]) {
+            const r = choose(i + 1, [...chosen, o]);
+            if (r)
+                return r;
+        }
         return undefined;
-    for (const [i, p] of fn.params.entries()) {
-        if (p.sort === 'nat' || p.sort === 'bool')
-            continue;
-        const own = `${fn.name}.${p.name}`;
-        if (calls.every(c => { const a = c.args[i]; return a.op === 'var' && c.fieldsOf.get(a.name) === own; }))
-            return i;
+    };
+    const got = fn.stated ? undefined : choose(0, []);
+    if (!got) {
+        const why = `${fn.name}: not structural recursion (no parameter whose field every recursive call passes${members.length > 1 ? `, in its ring ${members.map(f => f.name).join(', ')}` : ''}${fn.stated ? '; a measure is given' : ''})`;
+        if (members.length > 1)
+            throw new Error(`${why}, and a ring of functions is taken by structural recursion only`);
+        const t = termination(fn, why);
+        return { ring: [fn.name], measure: t.measure, termination: t };
+    }
+    const names = members.map(f => f.name);
+    members.forEach((f, a) => { f.rec = { decreases: got[a], ring: names }; });
+    return { decreases: got[0], ring: names };
+}
+export const terminationMs = { ms: 10_000 };
+const measurable = (s) => s === 'nat' || s instanceof Data;
+function measureOf(name, ps, m) {
+    if (!m.length)
+        throw new Error(`${name}: an empty measure`);
+    return { comps: m.map(c => {
+            const names = typeof c === 'string' ? [c] : c;
+            return { coef: ps.map(p => names.filter(n => n === p.name).length), c: names.every(n => ps.some(p => p.name === n && measurable(p.sort))) ? 0 : (() => { throw new Error(`${name}: a measure names its parameters of a datatype or naturals (${names.join(', ')})`); })() };
+        }) };
+}
+export const showMeasure = (f, m) => {
+    const comp = (c) => {
+        const parts = c.coef.flatMap((k, i) => (k ? [`${k < 0 ? '−' : ''}${Math.abs(k) === 1 ? '' : `${Math.abs(k)}·`}${f.params[i].sort === 'nat' ? f.params[i].name : `size(${f.params[i].name})`}`] : []));
+        const t = [...parts, ...(c.c ? [String(c.c)] : [])].join(' + ').replace(/\+ −/g, '− ');
+        return t || '0';
+    };
+    return m.comps.length === 1 ? comp(m.comps[0]) : `(${m.comps.map(comp).join(', ')})`;
+};
+// A component at arguments, as a term (its negative part subtracted, truncated as the encoding reads it).
+const sizeX = (s, a) => (s === 'nat' ? a : { op: 'size', data: s.name, of: a });
+export function measureX(f, c, args) {
+    const pos = [], neg = [];
+    c.coef.forEach((k, i) => { if (!k)
+        return; const t = sizeX(f.params[i].sort, args[i]); (k > 0 ? pos : neg).push(Math.abs(k) === 1 ? t : { op: 'mul', k: Math.abs(k), a: t }); });
+    if (c.c > 0)
+        pos.push({ op: 'nat', value: c.c });
+    if (c.c < 0)
+        neg.push({ op: 'nat', value: -c.c });
+    const sum = (ts) => (ts.length ? ts.reduce((a, b) => ({ op: 'add', a, b })) : { op: 'nat', value: 0 });
+    return neg.length ? { op: 'sub', a: sum(pos), b: sum(neg) } : sum(pos);
+}
+const lexY = (as, bs) => (as.length === 1 ? { op: '<', a: as[0], b: bs[0] } : { op: 'or', xs: [{ op: '<', a: as[0], b: bs[0] }, { op: 'and', xs: [{ op: '=', a: as[0], b: bs[0] }, lexY(as.slice(1), bs.slice(1))] }] });
+function callSites(fn) {
+    const out = [], yesX = { op: 'bool', c: yes.y };
+    const at = (sh, name) => { let t = sh.get(name); while (t && t.op === 'var' && sh.has(t.name))
+        t = sh.get(t.name); return t; };
+    const goY = (y, w) => {
+        switch (y.op) {
+            case '<':
+            case '<=':
+            case '=':
+            case 'i<':
+            case 'i<=':
+                goX(y.a, w);
+                goX(y.b, w);
+                return;
+            case 'and':
+            case 'or':
+                y.xs.forEach(z => goY(z, w));
+                return;
+            case 'not':
+                goY(y.x, w);
+                return;
+            case 'is':
+                goX(y.of, w);
+                return;
+            case 'holds':
+                goX(y.x, w);
+                return;
+        }
+    };
+    const goX = (x, w) => {
+        switch (x.op) {
+            case 'var':
+            case 'nat': return;
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod':
+            case 'iadd':
+            case 'isub':
+                goX(x.a, w);
+                goX(x.b, w);
+                return;
+            case 'mul':
+            case 'mod':
+            case 'div':
+            case 'imul':
+            case 'imod':
+            case 'idiv':
+            case 'ineg':
+            case 'ofnat':
+                goX(x.a, w);
+                return;
+            case 'int': return;
+            case 'apply':
+                goX(x.arg, w);
+                return;
+            case 'size':
+                goX(x.of, w);
+                return;
+            case 'bool':
+                goY(x.c, w);
+                return;
+            case 'ctor':
+                x.args.forEach(a => goX(a, w));
+                return;
+            case 'call':
+                x.args.forEach(a => goX(a, w));
+                if (x.fn === fn.name)
+                    out.push({ args: x.args, ...w });
+                return;
+            case 'if':
+                goY(x.c, w);
+                goX(x.then, { ...w, wrap: y => w.wrap({ op: 'or', xs: [{ op: 'not', x: x.c }, y] }) });
+                goX(x.else, { ...w, wrap: y => w.wrap({ op: 'or', xs: [x.c, y] }) });
+                return;
+            case 'match': {
+                goX(x.of, w);
+                const d = dataNamed(x.data), v = x.of.op === 'var' ? x.of.name : undefined, had = v ? at(w.shape, v) : undefined;
+                x.cases.forEach((c, j) => {
+                    if (v && had?.op === 'ctor') {
+                        // matched before on this path: the same case, its fields the ones bound then; another, never reached
+                        if (had.ctor === j)
+                            goX(c.body, { ...w, shape: new Map([...w.shape, ...c.binds.map((b, i) => [b, had.args[i]])]) });
+                        return;
+                    }
+                    if (v && !had) {
+                        const fields = c.binds.map((b, i) => ({ name: b, sort: fieldSort(d.ctors[j].fields[i]) }));
+                        goX(c.body, { wrap: w.wrap, shape: new Map([...w.shape, [v, { op: 'ctor', data: x.data, ctor: j, args: c.binds.map(b => ({ op: 'var', name: b })) }]]), vars: [...w.vars, ...fields] });
+                        return;
+                    }
+                    goX(c.body, { ...w, wrap: y => w.wrap({ op: 'holds', x: { op: 'match', data: x.data, of: x.of, cases: x.cases.map((c2, i) => ({ binds: c2.binds, body: i === j ? { op: 'bool', c: y } : yesX })) } }) });
+                });
+                return;
+            }
+            case 'natmatch': {
+                goX(x.of, w);
+                const v = x.of.op === 'var' ? x.of.name : undefined;
+                if (v && !at(w.shape, v)) {
+                    goX(x.zero, { ...w, shape: new Map([...w.shape, [v, { op: 'nat', value: 0 }]]) });
+                    goX(x.succ, { wrap: w.wrap, shape: new Map([...w.shape, [v, { op: 'add', a: { op: 'var', name: x.pred }, b: { op: 'nat', value: 1 } }]]), vars: [...w.vars, { name: x.pred, sort: 'nat' }] });
+                    return;
+                }
+                goX(x.zero, { ...w, wrap: y => w.wrap({ op: 'holds', x: { op: 'natmatch', of: x.of, zero: { op: 'bool', c: y }, pred: x.pred, succ: yesX } }) });
+                goX(x.succ, { ...w, wrap: y => w.wrap({ op: 'holds', x: { op: 'natmatch', of: x.of, zero: yesX, pred: x.pred, succ: { op: 'bool', c: y } } }) });
+                return;
+            }
+        }
+    };
+    goX(fn.body(), { wrap: y => y, shape: new Map(), vars: fn.params.map(q => ({ name: `${fn.name}.${q.name}`, sort: q.sort })) });
+    return out;
+}
+// The obligation of a call: under its path, the measure at its arguments below the measure at the parameters, a law over
+// the path's variables (the parameters not matched, the fields of the cases taken).
+function obligation(fn, m, s, i) {
+    const own = fn.params.map(q => ({ op: 'var', name: `${fn.name}.${q.name}` }));
+    const shaped = (t) => (Array.isArray(t) ? t.map(shaped) : t && typeof t === 'object' ? (t.op === 'var' && s.shape.has(t.name) ? shaped(s.shape.get(t.name)) : Object.fromEntries(Object.entries(t).map(([key, v]) => [key, shaped(v)]))) : t);
+    const holds = shaped(s.wrap(lexY(m.comps.map(c => measureX(fn, c, s.args)), m.comps.map(c => measureX(fn, c, own)))));
+    return { name: `${fn.name}'s call ${i + 1} lowers ${showMeasure(fn, m)}`, vars: s.vars.filter(v => !s.shape.has(v.name)), holds, params: [...new Set(paramsIn(holds))] };
+}
+// The calls the function's runs make, each from its parameters' sizes to its arguments' (random arguments, up to 2,000
+// calls a run: a run past that is cut, its calls kept).
+let tracing;
+function runEdges(fn) {
+    const rand = rng(17), edges = new Map();
+    const feat = (vs) => fn.params.map((p, i) => (p.sort === 'nat' ? vs[i] : p.sort instanceof Data ? sizeOf(p.sort, vs[i]) : 0));
+    const tables = new Map();
+    const params = new Proxy({}, { get: (_, key) => tables.get(key) ?? (tables.set(key, randomFn(rand)), tables.get(key)) });
+    for (let i = 0; i < 120 && edges.size < 400; i++) {
+        const vals = fn.params.map(p => randomValue(p.sort, rand, 1 + (i % 7)));
+        tracing = { fn: fn.name, stack: [], fuel: 2000, edge: (a, b) => { const e = { s: feat(a), t: feat(b) }; edges.set(JSON.stringify(e), e); } };
+        try {
+            evalX({ op: 'call', fn: fn.name, args: vals.map((_, j) => ({ op: 'var', name: `$a${j}` })) }, new Map(vals.map((v, j) => [`$a${j}`, v])), params);
+        }
+        catch { /* cut: its calls kept */ }
+        finally {
+            tracing = undefined;
+        }
+    }
+    return [...edges.values()];
+}
+const valueOf = (c, xs) => Math.max(0, c.coef.reduce((a, k, i) => a + k * xs[i], c.c));
+const lowers = (m, e) => {
+    for (const c of m.comps) {
+        const a = valueOf(c, e.t), b = valueOf(c, e.s);
+        if (a < b)
+            return true;
+        if (a > b)
+            return false;
+    }
+    return false;
+};
+function candidates(fn, edges) {
+    if (fn.stated)
+        return [fn.stated];
+    const ix = fn.params.flatMap((p, i) => (measurable(p.sort) ? [i] : [])), n = fn.params.length;
+    const one = (i) => ({ coef: fn.params.map((_, j) => (j === i ? 1 : 0)), c: 0 }), sum = (is) => ({ coef: fn.params.map((_, j) => (is.includes(j) ? 1 : 0)), c: 0 });
+    const out = ix.map(i => ({ comps: [one(i)] }));
+    for (const i of ix)
+        for (const j of ix)
+            if (i !== j)
+                out.push({ comps: [one(i), one(j)] });
+    for (const [a, i] of ix.entries())
+        for (const j of ix.slice(a + 1))
+            out.push({ comps: [sum([i, j])] });
+    if (ix.length <= 4)
+        for (const i of ix)
+            for (const j of ix)
+                for (const k of ix)
+                    if (i !== j && j !== k && i !== k)
+                        out.push({ comps: [one(i), one(j), one(k)] });
+    if (ix.length > 2)
+        out.push({ comps: [sum(ix)] });
+    // The LP's rank over the runs (coefficients and constants), where the runs give edges.
+    if (edges.length) {
+        const vars = ix.map(i => `p${i}`), env = (xs) => Object.fromEntries(ix.map(i => [`p${i}`, xs[i]]));
+        const r = ranksOfRuns(vars, edges.flatMap(e => [env(e.s), env(e.t)]), edges.map(e => ({ s: env(e.s), t: env(e.t) })));
+        if (!r.left && r.comps.length)
+            out.push({ comps: r.comps.map(c => ({ coef: Array.from({ length: n }, (_, j) => c.coef[`p${j}`] ?? 0), c: c.c })) });
+    }
+    return out;
+}
+// An obligation as one node of a cyclic proof (no use, no models): its conclusion, each definition it reads unfolded
+// once, the constructors' facts at the values built, the shape at each size it reads and at its variables of a
+// datatype, the congruences 16 random models' explanations use. The kernel checks it as any cyclic proof; undefined where it isn't proven.
+function directly(law, ms) {
+    const p = programOf([law]), fs = factsOf(p), concl = encY(p, law.holds, new Map());
+    varSorts = new Map(law.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : [])));
+    const until = clock() + ms;
+    const insts = instancesOf(p, fs, { roots: [concl], others: [], depth: 1, shapesAt: [...varSorts.keys()].map(ev), etaAt: [], models: modelsFor(p, law, 16, 3), until });
+    if (clock() > until)
+        return undefined;
+    const was = pairedKeys.skip;
+    pairedKeys.skip = true;
+    try {
+        const v = withDeadline(until, () => proveCyclic(fs.facts, [{ name: law.name, hyps: [], concl, rank: [k(0)], insts, uses: [] }]));
+        return v.proven && v.checked ? v : undefined;
+    }
+    finally {
+        pairedKeys.skip = was;
     }
-    throw new Error(`${fn.name}: not structural recursion (no parameter whose field every recursive call passes)`);
+}
+function termination(fn, why) {
+    return counted(dataRate, () => {
+        if (dataTrace)
+            console.error(`[data] termination of ${fn.name}`);
+        const t0 = performance.now(), sites = callSites(fn);
+        if (!fn.params.some(p => measurable(p.sort)))
+            throw new Error(`${why}, and it has no parameter a measure reads (a natural or a datatype value)`);
+        if (dataTrace)
+            console.error(`[data]   ${sites.length} calls`);
+        const edges = runEdges(fn), until = clock() + terminationMs.ms, tried = [], seen = new Set();
+        if (dataTrace)
+            console.error(`[data]   its runs: ${edges.length} calls at ${Math.round(performance.now() - t0)} ms`);
+        for (const m of candidates(fn, edges)) {
+            if (dataTrace)
+                console.error(`[data]   ${showMeasure(fn, m)} at ${Math.round(performance.now() - t0)} ms`);
+            if (clock() > until) {
+                tried.push('out of time');
+                break;
+            }
+            const text = showMeasure(fn, m), bad = edges.find(e => !lowers(m, e));
+            if (seen.has(text))
+                continue;
+            seen.add(text);
+            if (bad) {
+                if (fn.stated || !tried.length)
+                    tried.push(`${text}: a call of its runs doesn't lower it (from ${JSON.stringify(bad.s)} to ${JSON.stringify(bad.t)}, the parameters' sizes)`);
+                continue;
+            }
+            const obligations = [];
+            let failed;
+            for (const [i, site] of sites.entries()) {
+                const law = obligation(fn, m, site, i);
+                // A call nested in its own argument or condition: the obligation would read the function being taken.
+                if (programOf([law]).fns.some(g => g.name === fn.name))
+                    throw new Error(`${why}, and a call to itself is nested in the argument or the condition of another (nested recursion isn't taken)`);
+                // First one node, the definitions unfolded once (most calls lower the measure by their cases alone); else
+                // proveData: by induction where the obligation has a scheme (a call on a filter of the tail: the filter's own
+                // recursion), else, or then, the definitions unfolded alone.
+                const left = () => Math.max(1, until - clock()), cex = refute(law, 200);
+                if (cex) {
+                    failed = `${text}: its call ${i + 1} doesn't lower it at ${JSON.stringify(cex)}`;
+                    break;
+                }
+                const direct = directly(law, Math.min(2000, left()));
+                if (direct) {
+                    obligations.push({ law, proof: direct, lemmas: [] });
+                    continue;
+                }
+                const inductive = schemes(programOf([law]), law).length > 0;
+                // (no conjectured lemmas: their making isn't counted in the budget, and a call's decrease mostly needs none)
+                let v = proveData(law, inductive ? { ms: Math.min(12_000, left()), lemmas: false } : { induction: false, ms: Math.min(4000, left()) });
+                if (inductive && !(v.proven && v.checked) && !v.counterexample && clock() < until)
+                    v = proveData(law, { induction: false, ms: Math.min(4000, left()) });
+                if (!(v.proven && v.checked)) {
+                    failed = `${text}: its call ${i + 1} ${v.counterexample ? `doesn't lower it at ${JSON.stringify(v.counterexample)}` : 'not proven to lower it'}`;
+                    break;
+                }
+                obligations.push({ law, proof: v.proof, scheme: v.scheme, lemmas: v.lemmas });
+            }
+            if (!failed)
+                return { measure: m, text, obligations, ms: Math.round(performance.now() - t0) };
+            tried.push(failed);
+        }
+        throw new Error(`${why}, and no measure is proven to fall at every call${tried.length ? ` (${tried.slice(0, 3).join('; ')})` : ''}`);
+    });
 }
 export function law(name, vars, holds) {
     const vs = Object.entries(vars).map(([n, s]) => ({ name: n, sort: s }));
@@ -192,8 +700,20 @@ export function law(name, vars, holds) {
 }
 const fnOf = (name) => { const f = fns.get(name); if (!f)
     throw new Error(`no function ${name}`); return f; };
+// A function by its name, if one is defined (core/transfer.ts names its copies apart from every other).
+export const fnNamed = (name) => fns.get(name);
 const asNat = (v) => v;
-export function evalX(x, env, params) {
+// Evaluation within bounds: a natural past 2^53 (no longer exact) always throws EvalLimit, and within the search
+// (`evalBounds.on`: proveData, refute) so do calls nested past `depth` or past `calls` of one call's evaluation, which
+// recursive powers and factorials reach on small values. The sample that needs one is skipped (refute), the model's
+// read is unknown (the search).
+export class EvalLimit extends RangeError {
+}
+export const evalBounds = { on: false, depth: 1000, calls: 20_000 };
+let evalCalls = 0;
+const exact = (n) => { if (n > Number.MAX_SAFE_INTEGER)
+    throw new EvalLimit('past 2^53'); return n; };
+export function evalX(x, env, params, d = 0) {
     switch (x.op) {
         case 'var': {
             const v = env.get(x.name);
@@ -202,48 +722,95 @@ export function evalX(x, env, params) {
             return v;
         }
         case 'nat': return x.value;
-        case 'add': return asNat(evalX(x.a, env, params)) + asNat(evalX(x.b, env, params));
-        case 'sub': return Math.max(0, asNat(evalX(x.a, env, params)) - asNat(evalX(x.b, env, params)));
-        case 'min': return Math.min(asNat(evalX(x.a, env, params)), asNat(evalX(x.b, env, params)));
-        case 'max': return Math.max(asNat(evalX(x.a, env, params)), asNat(evalX(x.b, env, params)));
-        case 'mul': return x.k * asNat(evalX(x.a, env, params));
-        case 'if': return evalY(x.c, env, params) ? evalX(x.then, env, params) : evalX(x.else, env, params);
-        case 'bool': return evalY(x.c, env, params) ? 1 : 0;
-        case 'apply': return params[x.param](asNat(evalX(x.arg, env, params)));
-        case 'ctor': return { c: x.ctor, f: x.args.map(a => evalX(a, env, params)) };
+        case 'add': return exact(asNat(evalX(x.a, env, params, d)) + asNat(evalX(x.b, env, params, d)));
+        case 'sub': return Math.max(0, asNat(evalX(x.a, env, params, d)) - asNat(evalX(x.b, env, params, d)));
+        case 'min': return Math.min(asNat(evalX(x.a, env, params, d)), asNat(evalX(x.b, env, params, d)));
+        case 'max': return Math.max(asNat(evalX(x.a, env, params, d)), asNat(evalX(x.b, env, params, d)));
+        case 'mul': return exact(x.k * asNat(evalX(x.a, env, params, d)));
+        case 'prod': return exact(asNat(evalX(x.a, env, params, d)) * asNat(evalX(x.b, env, params, d)));
+        case 'mod': return asNat(evalX(x.a, env, params, d)) % x.k;
+        case 'div': return Math.floor(asNat(evalX(x.a, env, params, d)) / x.k);
+        case 'int': return x.value;
+        case 'iadd': return exact(asNat(evalX(x.a, env, params, d)) + asNat(evalX(x.b, env, params, d)));
+        case 'isub': return exact(asNat(evalX(x.a, env, params, d)) - asNat(evalX(x.b, env, params, d)));
+        case 'ineg': return -asNat(evalX(x.a, env, params, d));
+        case 'imul': return exact(x.k * asNat(evalX(x.a, env, params, d)));
+        case 'ofnat': return asNat(evalX(x.a, env, params, d));
+        case 'imod': return euclidMod(asNat(evalX(x.a, env, params, d)), x.k);
+        case 'idiv': {
+            const v = asNat(evalX(x.a, env, params, d));
+            return (v - euclidMod(v, x.k)) / x.k;
+        }
+        case 'if': return evalY(x.c, env, params, d) ? evalX(x.then, env, params, d) : evalX(x.else, env, params, d);
+        case 'bool': return evalY(x.c, env, params, d) ? 1 : 0;
+        case 'apply': return params[x.param](asNat(evalX(x.arg, env, params, d)));
+        case 'size': return sizeOf(dataNamed(x.data), evalX(x.of, env, params, d));
+        case 'ctor': return { c: x.ctor, f: x.args.map(a => evalX(a, env, params, d)) };
+        case 'natmatch': {
+            const n = asNat(evalX(x.of, env, params, d));
+            if (n === 0)
+                return evalX(x.zero, env, params, d);
+            const e2 = new Map(env);
+            e2.set(x.pred, n - 1);
+            return evalX(x.succ, e2, params, d);
+        }
         case 'match': {
-            const v = evalX(x.of, env, params), cs = x.cases[v.c];
+            const v = evalX(x.of, env, params, d), cs = x.cases[v.c];
             const e2 = new Map(env);
             cs.binds.forEach((b, i) => e2.set(b, v.f[i]));
-            return evalX(cs.body, e2, params);
+            return evalX(cs.body, e2, params, d);
         }
         case 'call': {
-            const f = fnOf(x.fn), body = f.body();
-            const e2 = new Map(f.params.map((p, i) => [`${f.name}.${p.name}`, evalX(x.args[i], env, params)]));
-            return evalX(body, e2, params);
+            const f = fnOf(x.fn), body = f.body(), vals = x.args.map(a => evalX(a, env, params, d));
+            const e2 = new Map(f.params.map((p, i) => [`${f.name}.${p.name}`, vals[i]]));
+            if (evalBounds.on) {
+                if (d === 0)
+                    evalCalls = 0;
+                if (d >= evalBounds.depth || ++evalCalls > evalBounds.calls)
+                    throw new EvalLimit(`${f.name}: past the evaluation's bounds`);
+            }
+            if (tracing?.fn !== f.name)
+                return evalX(body, e2, params, d + 1);
+            // A run of a function whose termination is being proven: each call recorded, the run cut past its fuel.
+            const t = tracing;
+            if (--t.fuel < 0)
+                throw new RangeError('out of fuel');
+            const top = t.stack.at(-1);
+            if (top)
+                t.edge(top, vals);
+            t.stack.push(vals);
+            try {
+                return evalX(body, e2, params, d + 1);
+            }
+            finally {
+                t.stack.pop();
+            }
         }
     }
 }
-export function evalY(y, env, params) {
+export function evalY(y, env, params, d = 0) {
     switch (y.op) {
-        case '<': return asNat(evalX(y.a, env, params)) < asNat(evalX(y.b, env, params));
-        case '<=': return asNat(evalX(y.a, env, params)) <= asNat(evalX(y.b, env, params));
-        case '=': return same(evalX(y.a, env, params), evalX(y.b, env, params));
-        case 'and': return y.xs.every(z => evalY(z, env, params));
-        case 'or': return y.xs.some(z => evalY(z, env, params));
-        case 'not': return !evalY(y.x, env, params);
-        case 'is': return evalX(y.of, env, params).c === y.ctor;
-        case 'holds': return evalX(y.x, env, params) === 1;
+        case '<': return asNat(evalX(y.a, env, params, d)) < asNat(evalX(y.b, env, params, d));
+        case '<=': return asNat(evalX(y.a, env, params, d)) <= asNat(evalX(y.b, env, params, d));
+        case 'i<': return asNat(evalX(y.a, env, params, d)) < asNat(evalX(y.b, env, params, d));
+        case 'i<=': return asNat(evalX(y.a, env, params, d)) <= asNat(evalX(y.b, env, params, d));
+        case '=': return same(evalX(y.a, env, params, d), evalX(y.b, env, params, d));
+        case 'and': return y.xs.every(z => evalY(z, env, params, d));
+        case 'or': return y.xs.some(z => evalY(z, env, params, d));
+        case 'not': return !evalY(y.x, env, params, d);
+        case 'is': return evalX(y.of, env, params, d).c === y.ctor;
+        case 'holds': return evalX(y.x, env, params, d) === 1;
     }
 }
+const euclidMod = (v, k) => ((v % k) + k) % k;
 const same = (a, b) => (typeof a === 'number' || typeof b === 'number' ? a === b : a.c === b.c && a.f.every((x, i) => same(x, b.f[i])));
 export const showValue = (d, v) => {
     if (typeof v === 'number')
         return String(v);
-    if (d === 'nat' || d === 'bool')
+    if (d === 'nat' || d === 'bool' || d === 'int')
         return JSON.stringify(v);
     const c = d.ctors[v.c];
-    return c.fields.length ? `${c.name}(${c.fields.map((f, i) => showValue(f.sort === 'nat' ? 'nat' : d, v.f[i])).join(', ')})` : c.name;
+    return c.fields.length ? `${c.name}(${c.fields.map((f, i) => showValue(fieldSort(f), v.f[i])).join(', ')})` : c.name;
 };
 export const rng = (seed) => () => { seed = (seed * 1103515245 + 12345) % 2147483648; return seed / 2147483648; };
 export function randomValue(s, rand, size, natMax = 5) {
@@ -251,11 +818,15 @@ export function randomValue(s, rand, size, natMax = 5) {
         return Math.floor(rand() * (natMax + 1));
     if (s === 'bool')
         return rand() < 0.5 ? 0 : 1;
-    const leaves = s.ctors.filter(c => c.fields.every(f => f.sort === 'nat'));
+    if (s === 'int')
+        return Math.floor(rand() * (2 * natMax + 1)) - natMax;
+    // The leaves: constructors of no field of the group, or (a datatype with none, a rose tree) those of least height.
+    const base = s.ctors.filter(c => c.fields.every(f => !inGroup(s, f)));
+    const leaves = base.length ? base : s.ctors.filter(c => s.ctorHeight(c) === s.height);
     const pick = size <= 0 || rand() < 0.25 ? leaves : s.ctors;
     const c = pick[Math.floor(rand() * pick.length)], j = s.ctors.indexOf(c);
-    const rec = c.fields.filter(f => f.sort === 'self').length;
-    return { c: j, f: c.fields.map(f => randomValue(f.sort === 'nat' ? 'nat' : s, rand, Math.floor((size - 1) / Math.max(1, rec)), natMax)) };
+    const rec = c.fields.filter(f => inGroup(s, f)).length;
+    return { c: j, f: c.fields.map(f => randomValue(fieldSort(f), rand, inGroup(s, f) ? Math.floor((size - 1) / Math.max(1, rec)) : Math.min(3, size), natMax)) };
 }
 // A random function of a natural: a table of small values.
 export const randomFn = (rand, natMax = 5) => { const t = new Map(); return n => { if (!t.has(n))
@@ -278,7 +849,7 @@ const yesC = leC(k(0), k(0));
 const pairE = (a, b) => { const s = { op: 'add', a, b }; return { op: 'add', a: { op: 'prod', a: s, b: s }, b }; };
 export const keyOf = (args) => args.slice(1).reduce(pairE, args[0]);
 // The arguments of a key built by keyOf (n of them), read back from its shape.
-function argsOf(key, n) {
+export function argsOf(key, n) {
     if (n === 1)
         return [key];
     if (key.op !== 'add' || key.a.op !== 'prod' || key.a.a.op !== 'add')
@@ -292,8 +863,13 @@ export const ctorMap = (d, j) => `${d.name}.${d.ctors[j].name}`;
 // Everything a law reads: the datatypes, the functions (with those they call), the function parameters.
 export function programOf(laws, extra = []) {
     const fs = new Map(), ds = new Map(), ps = new Set();
-    const addSort = (s) => { if (s instanceof Data)
-        ds.set(s.name, s); };
+    // A datatype with those its fields name (its group, those declared before it).
+    const addSort = (s) => { if (s instanceof Data && !ds.has(s.name)) {
+        ds.set(s.name, s);
+        for (const c of s.ctors)
+            for (const f of c.fields)
+                addSort(fieldSort(f));
+    } };
     const visit = (t) => walk(t, o => {
         if (o.op === 'call' && !fs.has(o.fn)) {
             const f = fnOf(o.fn);
@@ -304,6 +880,11 @@ export function programOf(laws, extra = []) {
         }
         if (o.op === 'apply')
             ps.add(o.param);
+        if (o.op === 'size')
+            addSort(dataNamed(o.data));
+        // (a datatype read only through a constructor, a match or a test of one: a law with a definition unfolded)
+        if ((o.op === 'ctor' || o.op === 'match' || o.op === 'is') && typeof o.data === 'string')
+            addSort(dataNamed(o.data));
     });
     for (const l of laws) {
         l.vars.forEach(v => addSort(v.sort));
@@ -311,7 +892,8 @@ export function programOf(laws, extra = []) {
     }
     for (const f of extra)
         visit({ op: 'call', fn: f.name, args: [] });
-    const datas = [...new Map([...ds.values()].map(d => [d.name, d])).values()];
+    // In order of declaration (each after those its fields name; a group together).
+    const datas = [...ds.values()].sort((a, b) => a.seq - b.seq);
     // Functions in definition order (each after those it calls).
     const order = [], seen = new Set();
     const place = (f) => { if (seen.has(f.name))
@@ -319,11 +901,95 @@ export function programOf(laws, extra = []) {
         place(fnOf(o.fn)); }); order.push(f); };
     for (const f of fs.values())
         place(f);
-    return { datas, fns: order, params: [...ps] };
+    // (the recursion of each checked)
+    for (const f of order)
+        void f.decreases;
+    const divs = new Set();
+    let ints = false;
+    const scan = (t) => walk(t, o => { if (o.op === 'mod' || o.op === 'div' || o.op === 'imod' || o.op === 'idiv')
+        divs.add(o.k); if (typeof o.op === 'string' && (intOps.has(o.op) || o.op === 'i<' || o.op === 'i<='))
+        ints = true; });
+    for (const l of laws) {
+        scan(l.holds);
+        if (l.vars.some(v => v.sort === 'int'))
+            ints = true;
+    }
+    for (const f of order) {
+        scan(f.body());
+        if (f.ret === 'int' || f.params.some(q => q.sort === 'int'))
+            ints = true;
+    }
+    for (const d of datas)
+        if (d.ctors.some(c => c.fields.some(f => f.sort === 'int')))
+            ints = true;
+    if (ints)
+        divs.add(2);
+    return { datas, fns: order, params: [...ps], divisors: [...divs].sort((a, b) => a - b), ints };
 }
 const dataOf = (p, name) => p.datas.find(d => d.name === name);
+// Division and remainder by a constant: the maps div$k and mod$k (core/machine.ts names them so), known by Euclid's fact
+// at each key read (`arith k`).
+export const divMap = (k) => `div$${k}`, modMap = (k) => `mod$${k}`;
+const arithMap = /^(?:div|mod)\$(\d+)$/;
+// Integers by their zigzag code: a code c is the integer p − n, p and n its value's two parts as maps of the code
+// (int$pos, int$neg), known by one fact (`zcode`): c + c mod 2 = 2p + 2n, p = 0 where c is odd, n = 0 where it is even;
+// a pair (p, n) has the code 2(p ∸ n) + (2(n ∸ p) ∸ 1). Neither direction needs an if, so the kernel splits only where a
+// proof needs the sign or the parity.
+export const zig = (z) => (z >= 0 ? 2 * z : -2 * z - 1);
+export const unzig = (c) => (c % 2 === 0 ? c / 2 : -(c + 1) / 2);
+const sumE = (a, b) => (a.op === 'const' && a.value === 0 ? b : b.op === 'const' && b.value === 0 ? a : { op: 'add', a, b });
+export const posMap = 'int$pos', negMap = 'int$neg';
+const pairOfCode = (c) => {
+    if (c.op === 'const') {
+        const z = unzig(c.value);
+        return [k(Math.max(z, 0)), k(Math.max(-z, 0))];
+    }
+    return [get(posMap, c), get(negMap, c)];
+};
+const codeOfPair = ([pos, neg]) => {
+    if (neg.op === 'const' && neg.value === 0)
+        return { op: 'mul', k: 2, a: pos };
+    return { op: 'add', a: { op: 'mul', k: 2, a: { op: 'sub', a: pos, b: neg } }, b: { op: 'sub', a: { op: 'mul', k: 2, a: { op: 'sub', a: neg, b: pos } }, b: k(1) } };
+};
+const intOps = new Set(['int', 'iadd', 'isub', 'ineg', 'imul', 'ofnat', 'imod', 'idiv']);
+// An integer term as the two naturals p − n of its value.
+function encI(p, x, env) {
+    if (x.op === 'int')
+        return [k(Math.max(x.value, 0)), k(Math.max(-x.value, 0))];
+    if (x.op === 'iadd' || x.op === 'isub') {
+        const [a, b] = [encI(p, x.a, env), encI(p, x.b, env)];
+        return x.op === 'iadd' ? [sumE(a[0], b[0]), sumE(a[1], b[1])] : [sumE(a[0], b[1]), sumE(a[1], b[0])];
+    }
+    if (x.op === 'ineg') {
+        const [pos, neg] = encI(p, x.a, env);
+        return [neg, pos];
+    }
+    if (x.op === 'imul') {
+        const [pos, neg] = encI(p, x.a, env), m = Math.abs(x.k), sc = (e) => (m === 1 ? e : { op: 'mul', k: m, a: e });
+        return x.k >= 0 ? [sc(pos), sc(neg)] : [sc(neg), sc(pos)];
+    }
+    if (x.op === 'ofnat')
+        return [encX(p, x.a, env), k(0)];
+    // pos + (k − 1)·neg is the value plus k·neg: the same remainder, and the quotient plus neg.
+    if (x.op === 'imod' || x.op === 'idiv') {
+        const [pos, neg] = encI(p, x.a, env), t = x.k === 1 ? pos : sumE(pos, { op: 'mul', k: x.k - 1, a: neg });
+        return x.op === 'imod' ? [get(modMap(x.k), t), k(0)] : [get(divMap(x.k), t), neg];
+    }
+    return pairOfCode(encX(p, x, env));
+}
 export function encX(p, x, env) {
     switch (x.op) {
+        case 'prod': return { op: 'prod', a: encX(p, x.a, env), b: encX(p, x.b, env) };
+        case 'mod': return get(modMap(x.k), encX(p, x.a, env));
+        case 'div': return get(divMap(x.k), encX(p, x.a, env));
+        case 'int': return k(zig(x.value));
+        case 'iadd':
+        case 'isub':
+        case 'ineg':
+        case 'imul':
+        case 'ofnat':
+        case 'imod':
+        case 'idiv': return codeOfPair(encI(p, x, env));
         case 'var': return env.get(x.name) ?? ev(x.name);
         case 'nat': return k(x.value);
         case 'add':
@@ -334,11 +1000,17 @@ export function encX(p, x, env) {
         case 'if': return { op: 'if', c: encY(p, x.c, env), then: encX(p, x.then, env), else: encX(p, x.else, env) };
         case 'bool': return { op: 'if', c: encY(p, x.c, env), then: k(1), else: k(0) };
         case 'apply': return get(x.param, encX(p, x.arg, env));
+        case 'size': return get(sizeMap(x.data), encX(p, x.of, env));
         case 'call': return get(x.fn, keyOf(x.args.map(a => encX(p, a, env))));
         case 'ctor': {
             const d = dataOf(p, x.data);
             return x.args.length ? get(ctorMap(d, x.ctor), keyOf(x.args.map(a => encX(p, a, env)))) : k(x.ctor);
         }
+        case 'natmatch': {
+            const of = encX(p, x.of, env), e2 = new Map(env);
+            e2.set(x.pred, { op: 'sub', a: of, b: k(1) });
+            return { op: 'if', c: eqC(of, k(0)), then: encX(p, x.zero, env), else: encX(p, x.succ, e2) };
+        }
         case 'match': {
             const d = dataOf(p, x.data), of = encX(p, x.of, env);
             const bodies = x.cases.map((c, j) => { const e2 = new Map(env); c.binds.forEach((b, i) => e2.set(b, get(fieldMap(d, j, i), of))); return encX(p, c.body, e2); });
@@ -348,9 +1020,20 @@ export function encX(p, x, env) {
 }
 export function encY(p, y, env) {
     switch (y.op) {
+        case 'i<':
+        case 'i<=': {
+            const [a, b] = [encI(p, y.a, env), encI(p, y.b, env)];
+            return { op: y.op === 'i<' ? '<' : '<=', a: sumE(a[0], b[1]), b: sumE(b[0], a[1]) };
+        }
+        // Two integers where one is arithmetic: equal values (the same as equal codes, without writing the sum's code).
+        case '=':
+            if (intOps.has(y.a.op) || intOps.has(y.b.op)) {
+                const [a, b] = [encI(p, y.a, env), encI(p, y.b, env)];
+                return { op: '=', a: sumE(a[0], b[1]), b: sumE(b[0], a[1]) };
+            }
+            return { op: '=', a: encX(p, y.a, env), b: encX(p, y.b, env) };
         case '<':
-        case '<=':
-        case '=': return { op: y.op, a: encX(p, y.a, env), b: encX(p, y.b, env) };
+        case '<=': return { op: y.op, a: encX(p, y.a, env), b: encX(p, y.b, env) };
         case 'and':
         case 'or': return { op: y.op, xs: y.xs.map(z => encY(p, z, env)) };
         case 'not': return { op: 'not', x: encY(p, y.x, env) };
@@ -366,7 +1049,7 @@ export function factsOf(p) {
         const tag = get(tagMap(d.name), x), size = (t) => get(sizeMap(d.name), t);
         // Under tag j: the size, and every field of another constructor 0 (what Lean's model reads there).
         const under = (c, j) => {
-            const sz = c.fields.flatMap((f, i) => (f.sort === 'self' ? [size(get(fieldMap(d, j, i), x))] : [])).reduce((a, b) => ({ op: 'add', a, b }), k(1));
+            const sz = c.fields.flatMap((f, i) => (inGroup(d, f) ? [get(sizeMap(f.sort.data), get(fieldMap(d, j, i), x))] : [])).reduce((a, b) => ({ op: 'add', a, b }), k(1));
             const others = d.ctors.flatMap((c2, j2) => (j2 === j ? [] : c2.fields.map((_, i2) => eqC(get(fieldMap(d, j2, i2), x), k(0)))));
             return andC(eqC(size(x), sz), ...others);
         };
@@ -388,6 +1071,18 @@ export function factsOf(p) {
         const body = encX(p, f.body(), new Map());
         put(`fn ${f.name}`, { name: '', keys, holds: andC(eqC(get(f.name, keyOf(keys.map(ev))), body), ...(f.ret === 'bool' ? [leC(get(f.name, keyOf(keys.map(ev))), k(1))] : [])) });
     }
+    // Euclid's division by each divisor: x = k·(x div k) + x mod k, x mod k < k.
+    for (const k2 of p.divisors) {
+        put(`arith ${k2}`, { name: '', keys: ['x$'], holds: andC(eqC(x, { op: 'add', a: { op: 'mul', k: k2, a: get(divMap(k2), x) }, b: get(modMap(k2), x) }), { op: '<', a: get(modMap(k2), x), b: k(k2) }) });
+        arity.set(divMap(k2), 1);
+        arity.set(modMap(k2), 1);
+    }
+    if (p.ints) {
+        const pos = get(posMap, x), neg = get(negMap, x), par = get(modMap(2), x);
+        put('zcode', { name: '', keys: ['x$'], holds: andC(eqC({ op: 'add', a: x, b: par }, { op: 'add', a: { op: 'mul', k: 2, a: pos }, b: { op: 'mul', k: 2, a: neg } }), { op: 'or', xs: [eqC(par, k(0)), eqC(pos, k(0))] }, { op: 'or', xs: [eqC(par, k(1)), eqC(neg, k(0))] }) });
+        arity.set(posMap, 1);
+        arity.set(negMap, 1);
+    }
     // Every map the encoding reads: the datatypes' tag, size and fields too (each of one argument).
     for (const d of p.datas) {
         arity.set(tagMap(d.name), 1);
@@ -420,14 +1115,14 @@ export function decode(d, n) {
     if (n < z)
         return { c: n, f: [] };
     const q = Math.floor((n - z) / m), j = z + ((n - z) % m), c = d.ctors[j];
-    return { c: j, f: c.fields.map((f, i) => { const x = tup(q, c.fields.length, i); return f.sort === 'nat' ? x : decode(d, x); }) };
+    return { c: j, f: c.fields.map((f, i) => { const x = tup(q, c.fields.length, i); return f.sort === 'nat' ? x : f.sort === 'int' ? unzig(x) : decode(dataNamed(f.sort.data), x); }) };
 }
 export function encode(d, v) {
     const o = v, z = d.nullary, m = d.ctors.length - z;
     if (o.c < z)
         return o.c;
     const c = d.ctors[o.c];
-    return safe(z + m * tupk(c.fields.map((f, i) => (f.sort === 'nat' ? o.f[i] : encode(d, o.f[i])))) + (o.c - z));
+    return safe(z + m * tupk(c.fields.map((f, i) => (f.sort === 'nat' ? o.f[i] : f.sort === 'int' ? zig(o.f[i]) : encode(dataNamed(f.sort.data), o.f[i])))) + (o.c - z));
 }
 // Each map of the encoding as a function of its arguments, on the codes (for core/cycles.ts's runs).
 export function codeValues(p) {
@@ -436,20 +1131,28 @@ export function codeValues(p) {
         out[tagMap(d.name)] = n => decode(d, n).c;
         out[sizeMap(d.name)] = n => sizeOf(d, decode(d, n));
         d.ctors.forEach((c, j) => {
-            c.fields.forEach((f, i) => { out[fieldMap(d, j, i)] = n => { const v = decode(d, n); return v.c === j ? (f.sort === 'nat' ? v.f[i] : encode(d, v.f[i])) : 0; }; });
+            c.fields.forEach((f, i) => { out[fieldMap(d, j, i)] = n => { const v = decode(d, n); return v.c === j ? (f.sort === 'nat' ? v.f[i] : f.sort === 'int' ? zig(v.f[i]) : encode(dataNamed(f.sort.data), v.f[i])) : 0; }; });
             if (c.fields.length)
-                out[ctorMap(d, j)] = (...xs) => encode(d, { c: j, f: c.fields.map((f, i) => (f.sort === 'nat' ? xs[i] : decode(d, xs[i]))) });
+                out[ctorMap(d, j)] = (...xs) => encode(d, { c: j, f: c.fields.map((f, i) => (f.sort === 'nat' ? xs[i] : f.sort === 'int' ? unzig(xs[i]) : decode(dataNamed(f.sort.data), xs[i]))) });
         });
     }
     for (const f of p.fns)
         out[f.name] = (...xs) => {
-            const v = evalX(f.body(), new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, q.sort instanceof Data ? decode(q.sort, xs[i]) : xs[i]])), {});
-            return f.ret instanceof Data ? encode(f.ret, v) : v;
+            const v = evalX(f.body(), new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, q.sort instanceof Data ? decode(q.sort, xs[i]) : q.sort === 'int' ? unzig(xs[i]) : xs[i]])), {});
+            return f.ret instanceof Data ? encode(f.ret, v) : f.ret === 'int' ? zig(v) : v;
         };
+    for (const k2 of p.divisors) {
+        out[divMap(k2)] = n => Math.floor(n / k2);
+        out[modMap(k2)] = n => n % k2;
+    }
+    if (p.ints) {
+        out[posMap] = n => Math.max(unzig(n), 0);
+        out[negMap] = n => Math.max(-unzig(n), 0);
+    }
     return out;
 }
 // That a value's fields of its datatype have smaller codes (true of the codes above: each field at most q).
-export const orderFacts = (p) => p.datas.map(d => ({ name: `order ${d.name}`, keys: ['x$'], holds: andC(yesC, ...d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort === 'self' ? [implies(eqC(get(tagMap(d.name), ev('x$')), k(j)), { op: '<', a: get(fieldMap(d, j, i), ev('x$')), b: ev('x$') })] : [])))) }));
+export const orderFacts = (p) => p.datas.map(d => ({ name: `order ${d.name}`, keys: ['x$'], holds: andC(yesC, ...d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (isDataField(f.sort) && f.sort.data === d.name ? [implies(eqC(get(tagMap(d.name), ev('x$')), k(j)), { op: '<', a: get(fieldMap(d, j, i), ev('x$')), b: ev('x$') })] : [])))) }));
 // --- concrete models: a value of the encoding at random values (which terms are equal, for congruences and matches) ----
 // Values interned per datatype: a constructor of no field is its tag; the rest numbered from there. A key is a
 // pairing's natural, read back through its square root.
@@ -490,8 +1193,8 @@ export class Model {
         return v;
     }
     // A value of a sort as the encoding's natural, and back.
-    code(s, v) { return s instanceof Data ? this.id(s, v) : v; }
-    decode(s, n) { return s instanceof Data ? this.value(s, n) : n; }
+    code(s, v) { return s instanceof Data ? this.id(s, v) : s === 'int' ? zig(v) : v; }
+    decode(s, n) { return s instanceof Data ? this.value(s, n) : s === 'int' ? unzig(n) : n; }
     memo = new Map();
     read(map, key) {
         const at = `${map}|${key}`, had = this.memo.get(at);
@@ -513,11 +1216,11 @@ export class Model {
                 for (const [i, f] of c.fields.entries())
                     if (map === fieldMap(d, j, i)) {
                         const v = this.value(d, key);
-                        return v.c === j ? this.code(f.sort === 'nat' ? 'nat' : d, v.f[i]) : 0;
+                        return v.c === j ? this.code(fieldSort(f), v.f[i]) : 0;
                     }
                 if (c.fields.length && map === ctorMap(d, j)) {
                     const as = unkey(key, c.fields.length);
-                    return this.id(d, { c: j, f: c.fields.map((f, i) => this.decode(f.sort === 'nat' ? 'nat' : d, as[i])) });
+                    return this.id(d, { c: j, f: c.fields.map((f, i) => this.decode(fieldSort(f), as[i])) });
                 }
             }
         }
@@ -526,8 +1229,17 @@ export class Model {
             const as = unkey(key, f.params.length);
             const env = new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, this.decode(q.sort, as[i])]));
             const out = evalX(f.body(), env, this.params);
-            return f.ret === 'nat' || f.ret === 'bool' ? out : this.id(f.ret, out);
+            return f.ret === 'nat' || f.ret === 'bool' ? out : f.ret === 'int' ? zig(out) : this.id(f.ret, out);
+        }
+        const ar = arithMap.exec(map);
+        if (ar) {
+            const k2 = Number(ar[1]);
+            return map.startsWith('mod') ? key % k2 : Math.floor(key / k2);
         }
+        if (map === posMap)
+            return Math.max(unzig(key), 0);
+        if (map === negMap)
+            return Math.max(-unzig(key), 0);
         const prm = this.params[map];
         if (prm)
             return prm(key);
@@ -576,7 +1288,7 @@ export class Model {
         }
     }
 }
-export const sizeOf = (d, v) => { const o = v; return 1 + d.ctors[o.c].fields.reduce((s, f, i) => s + (f.sort === 'self' ? sizeOf(d, o.f[i]) : 0), 0); };
+export const sizeOf = (d, v) => { const o = v; return 1 + d.ctors[o.c].fields.reduce((s, f, i) => s + (inGroup(d, f) ? sizeOf(fieldSort(f), o.f[i]) : 0), 0); };
 const isqrt = (n) => { let s = Math.floor(Math.sqrt(n)); while (s * s > n)
     s--; while ((s + 1) * (s + 1) <= n)
     s++; return s; };
@@ -587,20 +1299,176 @@ export function unkey(key, n) {
     return [...unkey(a, n - 1), b];
 }
 // Random values of the law's variables: a law false at one is refuted with it.
+// A sample whose evaluation passes the bounds (EvalLimit, or the stack) is skipped.
 export function refute(l, n = 400, seed = 7) {
-    for (const s of samples(l.vars, programOf([l]).params, n, seed)) {
-        let ok;
-        try {
-            ok = evalY(l.holds, s.env, s.params);
+    return bounded(() => {
+        for (const s of samples(l.vars, programOf([l]).params, n, seed)) {
+            let ok;
+            try {
+                ok = evalY(l.holds, s.env, s.params);
+            }
+            catch (e) {
+                if (e instanceof RangeError)
+                    continue;
+                throw new Error(`${l.name}: ${e.message}`);
+            }
+            if (!ok)
+                return Object.fromEntries(l.vars.map(v => [v.name, showValue(v.sort, s.env.get(v.name))]));
         }
-        catch (e) {
-            throw new Error(`${l.name}: ${e.message}`);
+        return undefined;
+    });
+}
+const bounded = (f) => { const was = evalBounds.on; evalBounds.on = true; try {
+    return f();
+}
+finally {
+    evalBounds.on = was;
+} };
+// The function a function f calls at its decreasing argument's field of datatype `to` (a rose tree's sum, at its forest:
+// the forest's sum): the call, the same for every such field, its other arguments f's own parameters or closed terms.
+function partner(f, to) {
+    const di = f.decreases;
+    if (di === undefined)
+        return undefined;
+    const own = `${f.name}.${f.params[di].name}`, found = new Map();
+    let bad = false;
+    const go = (x, fields) => {
+        if (!x || typeof x !== 'object')
+            return;
+        if (Array.isArray(x)) {
+            x.forEach(y => go(y, fields));
+            return;
+        }
+        const t = x;
+        if (t.op === 'match' && t.of.op === 'var' && t.of.name === own) {
+            const d = dataNamed(t.data);
+            t.cases.forEach((c, j) => go(c.body, new Set([...fields, ...c.binds.filter((_, i) => { const fl = d.ctors[j].fields[i]; return isDataField(fl.sort) && fl.sort.data === to.name; })])));
+            return;
         }
+        if (t.op === 'call') {
+            const g = fnOf(t.fn), gd = g.decreases, at = gd === undefined ? undefined : t.args[gd];
+            if (at?.op === 'var' && fields.has(at.name)) {
+                const args = t.args.map((a, i) => (i === gd ? -1 : a.op === 'var' && a.name.startsWith(`${f.name}.`) ? f.params.findIndex(q => `${f.name}.${q.name}` === a.name) : !JSON.stringify(a).includes('"op":"var"') ? a : undefined));
+                if (args.some(a => a === undefined))
+                    bad = true;
+                else
+                    found.set(JSON.stringify([g.name, args]), { fn: g, args: args });
+            }
+        }
+        for (const v of Object.values(t))
+            go(v, fields);
+    };
+    go(f.body(), new Set());
+    return !bad && found.size === 1 ? [...found.values()][0] : undefined;
+}
+// The law said of a value of datatype `to` in place of v: v a variable of `to`, and each call whose decreasing argument
+// is then of `to` (no longer of its own datatype) its function's partner at `to`; none where a sort no longer fits (an
+// argument, a comparison).
+function companionOf(l, v, to, name) {
+    // (a sort unknown, an if's or a match's, fits any)
+    const sorts = new Map(l.vars.map(x => [x.name, x.sort])), same = (a, b) => a === undefined || b === undefined || (a instanceof Data ? a.name : a) === (b instanceof Data ? b.name : b);
+    const sortOf = (x, renamed) => (x.op === 'var' ? (renamed && x.name === name ? to : sorts.get(x.name)) : x.op === 'call' ? fnOf(x.fn).ret : x.op === 'ctor' ? dataNamed(x.data) : x.op === 'match' || x.op === 'if' ? undefined : 'nat');
+    let ok = true;
+    const lift = (t) => {
         if (!ok)
-            return Object.fromEntries(l.vars.map(v => [v.name, showValue(v.sort, s.env.get(v.name))]));
+            return t;
+        if (Array.isArray(t))
+            return t.map(lift);
+        if (!t || typeof t !== 'object')
+            return t;
+        const o = t;
+        if (o.op === 'var' && o.name === v)
+            return { op: 'var', name };
+        if (o.op === 'call') {
+            const f = fnOf(o.fn), di = f.decreases, as = o.args.map(a => lift(a));
+            if (di !== undefined && !same(sortOf(as[di], true), sortOf(o.args[di], false))) {
+                const pt = partner(f, to);
+                if (!pt || !same(sortOf(as[di], true), to)) {
+                    ok = false;
+                    return o;
+                }
+                const args = pt.args.map(a => (a === -1 ? as[di] : typeof a === 'number' ? as[a] : a));
+                if (args.some((a, i) => i !== pt.fn.decreases && !same(sortOf(a, true), pt.fn.params[i].sort))) {
+                    ok = false;
+                    return o;
+                }
+                return { op: 'call', fn: pt.fn.name, args };
+            }
+            if (as.some((a, i) => !same(sortOf(a, true), f.params[i].sort))) {
+                ok = false;
+                return o;
+            }
+            return { ...o, args: as };
+        }
+        if (o.op === 'ctor') {
+            const d = dataNamed(o.data), as = o.args.map(a => lift(a));
+            if (as.some((a, i) => !same(sortOf(a, true), fieldSort(d.ctors[o.ctor].fields[i]))))
+                ok = false;
+            return { ...o, args: as };
+        }
+        const out = Object.fromEntries(Object.entries(o).map(([key, x]) => [key, lift(x)]));
+        if (out.op === '=' && !same(sortOf(out.a, true), sortOf(out.b, true)))
+            ok = false;
+        const om = o;
+        if (om.op === 'match' && !same(sortOf(out.of, true), dataNamed(om.data)))
+            ok = false;
+        return out;
+    };
+    const holds = lift(l.holds);
+    if (!ok || !JSON.stringify(holds).includes(JSON.stringify({ op: 'var', name })))
+        return undefined;
+    return { name: `${l.name}, at ${to.name}`, vars: l.vars.map(x => (x.name === v ? { name, sort: to } : x)), holds, params: l.params };
+}
+// The mutual scheme on v: the companions of the datatypes v's fields reach (through the group), or none.
+function mutualScheme(l, v, d) {
+    const at = new Map([[d.name, { law: l, v }]]), todo = [d];
+    while (todo.length) {
+        const x = todo.shift(), from = at.get(x.name);
+        for (const c of x.ctors)
+            for (const f of c.fields) {
+                if (!inGroup(x, f) || at.has(f.sort.data))
+                    continue;
+                const to = dataNamed(f.sort.data), name = `${v}${to.name}`, law = companionOf(from.law, from.v, to, name);
+                if (!law)
+                    return undefined;
+                at.set(to.name, { law, v: name });
+                todo.push(to);
+            }
     }
-    return undefined;
+    if (at.size < 2)
+        return undefined;
+    const order = [...at.keys()];
+    const usesOf = (x, xv) => x.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (inGroup(x, f) && at.has(f.sort.data)
+        ? [{ subst: { [at.get(f.sort.data).v]: get(fieldMap(x, j, i), ev(xv)) }, guard: eqC(get(tagMap(x.name), ev(xv)), k(j)), member: order.indexOf(f.sort.data) }] : [])));
+    return { name: `mutual structure of ${v}`, on: { v, d }, uses: usesOf(d, v), companions: order.slice(1).map(n => { const x = dataNamed(n), a = at.get(n); return { law: a.law, on: { v: a.v, d: x }, uses: usesOf(x, a.v) }; }) };
 }
+// The width of a program's ranks' middle: its widest measure (1 when every recursion is structural).
+const rankWidth = (p) => Math.max(1, ...p.fns.map(f => (f.decreases === undefined ? f.measure?.comps.length ?? 1 : 1)));
+// Where a well-founded scheme's node wants a datatype's shape: at the values its measure reads, and at those its measure
+// reads at each use (a constructor's value a call passes: its size from its fields).
+function rankShapes(shapes, rank, uses) {
+    const out = new Map(shapes.map(e => [tid(e), e]));
+    walk(uses.map(u => rank.map(e => substE(e, { vars: u.subst, maps: {}, flags: {} }))), o => { if (o.op === 'get' && o.map.endsWith('.size'))
+        out.set(tid(o.key), o.key); });
+    return [...out.values()];
+}
+// The parameters a function's definition is decided at when they are a constructor's value: a structural one's
+// decreasing parameter (a datatype's), a well-founded one's parameters of a datatype its body matches on.
+function unfoldAt(f) {
+    if (f.decreases !== undefined)
+        return f.params[f.decreases].sort instanceof Data ? [f.decreases] : [];
+    if (!f.measure)
+        return [];
+    const out = new Set();
+    walk(f.body(), o => { if (o.op === 'match' && o.of.op === 'var') {
+        const i = f.params.findIndex(q => `${f.name}.${q.name}` === o.of.name);
+        if (i >= 0 && f.params[i].sort instanceof Data)
+            out.add(i);
+    } });
+    return [...out];
+}
+// The inductions the search tries for a law (its schemes), for tests.
+export const schemesOf = (p, l) => schemes(p, l);
 function schemes(p, l) {
     const out = [], seen = new Set();
     const add = (s) => { const id = JSON.stringify(s.uses); if (!seen.has(id)) {
@@ -614,12 +1482,13 @@ function schemes(p, l) {
             return;
         const f = fnOf(o.fn), args = o.args;
         f.body();
-        if (f.decreases === undefined)
+        const m = f.decreases === undefined ? f.measure : undefined;
+        if (f.decreases === undefined && !m)
             return;
-        const at = args[f.decreases];
-        if (at.op !== 'var' || !l.vars.some(v => v.name === at.name))
+        const at = args[f.decreases ?? 0];
+        if (!m && (at.op !== 'var' || !l.vars.some(v => v.name === at.name)))
             return;
-        const d = f.params[f.decreases].sort;
+        const d = f.params[f.decreases ?? 0].sort;
         const formal = new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, args[i].op === 'var' && l.vars.some(v => v.name === args[i].name) ? ev(args[i].name) : undefined]));
         const uses = [];
         const go = (x, env, guard) => {
@@ -636,6 +1505,22 @@ function schemes(p, l) {
                 t.cases.forEach((c, j) => { const e2 = new Map(env); c.binds.forEach((b, i) => e2.set(b, get(fieldMap(dd, j, i), of))); go(c.body, e2, [...guard, eqC(get(tagMap(dd.name), of), k(j))]); });
                 return;
             }
+            if (t.op === 'natmatch') {
+                go(t.of, env, guard);
+                const of = encX(p, t.of, env), e2 = new Map(env);
+                go(t.zero, env, [...guard, eqC(of, k(0))]);
+                e2.set(t.pred, { op: 'sub', a: of, b: k(1) });
+                go(t.succ, e2, [...guard, { op: 'not', x: eqC(of, k(0)) }]);
+                return;
+            }
+            // (a well-founded call's descent may need its if's condition: x − y below x where y ≤ x)
+            if (m && t.op === 'if') {
+                const c = encY(p, t.c, env);
+                go(t.c, env, guard);
+                go(t.then, env, [...guard, c]);
+                go(t.else, env, [...guard, { op: 'not', x: c }]);
+                return;
+            }
             if (t.op === 'call' && t.fn === f.name) {
                 const subst = {};
                 let ok = true;
@@ -657,21 +1542,34 @@ function schemes(p, l) {
         };
         const env = new Map([...formal].flatMap(([key, e]) => (e ? [[key, e]] : [])));
         go(f.body(), env, []);
-        if (uses.length)
+        if (!uses.length)
+            return;
+        if (!m) {
             add({ name: `recursion of ${f.name} on ${at.name}`, on: { v: at.name, d }, uses });
+            return;
+        }
+        // Well-founded: ranked by the measure at the law's arguments; the law's variables it reads named.
+        const read = f.params.flatMap((q, i) => (m.comps.some(c => c.coef[i]) && args[i].op === 'var' && l.vars.some(v => v.name === args[i].name) ? [{ i, v: args[i].name }] : []));
+        add({ name: `recursion of ${f.name} on ${read.map(r => r.v).join(', ') || 'its arguments'}`, uses, rank: m.comps.map(c => encX(p, measureX(f, c, args), new Map())),
+            shapes: read.filter(r => f.params[r.i].sort instanceof Data).map(r => ev(r.v)) });
     });
-    // Structural induction on each variable of a datatype, the others fixed.
+    // Structural induction on each variable of a datatype, the others fixed; mutual where its fields reach another of its
+    // group (the law and its companions), plain where they reach none or no companion is found.
     for (const v of l.vars) {
         if (!(v.sort instanceof Data))
             continue;
-        const d = v.sort, x = ev(v.name);
-        add({ name: `structure of ${v.name}`, on: { v: v.name, d }, uses: d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort === 'self' ? [{ subst: { [v.name]: get(fieldMap(d, j, i), x) }, guard: eqC(get(tagMap(d.name), x), k(j)) }] : []))) });
+        const d = v.sort, x = ev(v.name), mut = mutualScheme(l, v.name, d);
+        if (mut) {
+            out.push(mut);
+            continue;
+        }
+        add({ name: `structure of ${v.name}`, on: { v: v.name, d }, uses: d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (isDataField(f.sort) && f.sort.data === d.name ? [{ subst: { [v.name]: get(fieldMap(d, j, i), x) }, guard: eqC(get(tagMap(d.name), x), k(j)) }] : []))) });
     }
     return out;
 }
 function instancesOf(p, fs, w) {
     // Past the attempt's time, what is found so far (the attempt then fails or proves with it).
-    const late = () => w.until !== undefined && performance.now() > w.until;
+    const late = () => w.until !== undefined && clock() > w.until;
     const tt = performance.now(), lap = (what) => { if (dataTrace)
         console.error(`[data]   instances: ${what} at ${Math.round(performance.now() - tt)} ms`); };
     const insts = [], seen = new Set();
@@ -727,10 +1625,27 @@ function instancesOf(p, fs, w) {
             inst(`fn ${f.name}`, as);
             const body = reads(holdsAt(`fn ${f.name}`, as));
             ctors(note(body));
-            next.push(...body);
+            for (const b of body)
+                next.push(b);
         }
         frontier = next;
     }
+    // Euclid's fact at every key a remainder or quotient is read at (a read the facts bring is read too).
+    const ariths = () => {
+        for (let pass = 0; pass < 2; pass++)
+            for (const r of [...all]) {
+                if (r.map === posMap || r.map === negMap) {
+                    inst('zcode', [r.key]);
+                    note(reads(holdsAt('zcode', [r.key])));
+                }
+                const m = arithMap.exec(r.map);
+                if (m) {
+                    inst(`arith ${m[1]}`, [r.key]);
+                    note(reads(holdsAt(`arith ${m[1]}`, [r.key])));
+                }
+            }
+    };
+    ariths();
     lap(`unfolded, ${insts.length} instances, ${all.length} reads`);
     const closure = (model) => {
         const parent = new Map(), terms = new Map(), adj = new Map();
@@ -836,29 +1751,31 @@ function instancesOf(p, fs, w) {
             }
             for (const r of [...all]) {
                 const f = fnOfMap(r.map);
-                if (!f || f.decreases === undefined)
+                if (!f)
                     continue;
                 const as = argsOf(r.key, f.params.length);
                 if (!as)
                     continue;
-                const own = as[f.decreases], d = f.params[f.decreases].sort, root = cl.find(tid(own));
-                const built = (t) => (t.op === 'get' && d.ctors.some((c, j) => c.fields.length && t.map === ctorMap(d, j))) || (t.op === 'const' && t.value < d.nullary);
-                const cands = built(own) ? [own] : [...cl.terms.values()].filter(t => built(t) && cl.find(tid(t)) === root);
-                for (const t of cands) {
-                    const as2 = as.map((a, i) => (i === f.decreases ? t : a)), rid = JSON.stringify({ map: f.name, key: keyOf(as2) }), key2 = JSON.stringify([fs.at.get(`fn ${f.name}`), as2]);
-                    const anchor = { read: tid(get(f.name, r.key)), arg: own, value: t }, had = anchoredAt.get(key2) ?? [];
-                    if (!had.some(x => x.read === anchor.read))
-                        anchoredAt.set(key2, [...had, anchor]);
-                    if (unfolded.has(rid) || extra >= 12 || done.has(sigOf(f.name, as2)))
-                        continue;
-                    unfolded.add(rid);
-                    extra++;
-                    done.add(sigOf(f.name, as2));
-                    if (dataTrace)
-                        console.error(`[data]     unfold ${f.name} at ${JSON.stringify(as2).slice(0, 160)} for ${JSON.stringify(r.key).slice(0, 80)}`);
-                    inst(`fn ${f.name}`, as2);
-                    note([{ map: f.name, key: keyOf(as2) }]);
-                    ctors(note(reads(holdsAt(`fn ${f.name}`, as2))));
+                for (const di of unfoldAt(f)) {
+                    const own = as[di], d = f.params[di].sort, root = cl.find(tid(own));
+                    const built = (t) => (t.op === 'get' && d.ctors.some((c, j) => c.fields.length && t.map === ctorMap(d, j))) || (t.op === 'const' && t.value < d.nullary);
+                    const cands = built(own) ? [own] : [...cl.terms.values()].filter(t => built(t) && cl.find(tid(t)) === root);
+                    for (const t of cands) {
+                        const as2 = as.map((a, i) => (i === di ? t : a)), rid = JSON.stringify({ map: f.name, key: keyOf(as2) }), key2 = JSON.stringify([fs.at.get(`fn ${f.name}`), as2]);
+                        const anchor = { read: tid(get(f.name, r.key)), arg: own, value: t }, had = anchoredAt.get(key2) ?? [];
+                        if (!had.some(x => x.read === anchor.read))
+                            anchoredAt.set(key2, [...had, anchor]);
+                        if (unfolded.has(rid) || extra >= 12 || done.has(sigOf(f.name, as2)))
+                            continue;
+                        unfolded.add(rid);
+                        extra++;
+                        done.add(sigOf(f.name, as2));
+                        if (dataTrace)
+                            console.error(`[data]     unfold ${f.name} at ${JSON.stringify(as2).slice(0, 160)} for ${JSON.stringify(r.key).slice(0, 80)}`);
+                        inst(`fn ${f.name}`, as2);
+                        note([{ map: f.name, key: keyOf(as2) }]);
+                        ctors(note(reads(holdsAt(`fn ${f.name}`, as2))));
+                    }
                 }
             }
         }
@@ -877,8 +1794,8 @@ function instancesOf(p, fs, w) {
                     if (c.fields.length && t.map === ctorMap(d, j))
                         return d;
                     for (const [i, fl] of c.fields.entries())
-                        if (fl.sort === 'self' && t.map === fieldMap(d, j, i))
-                            return d;
+                        if (isDataField(fl.sort) && t.map === fieldMap(d, j, i))
+                            return dataNamed(fl.sort.data);
                 }
         }
         return undefined;
@@ -889,6 +1806,12 @@ function instancesOf(p, fs, w) {
     } };
     for (const t of w.shapesAt)
         shape(t, typeOfVar(p, t));
+    // A size the goal reads (a measure's, in a well-founded call's obligation): the shape of its value, which gives the
+    // size from the fields.
+    for (const r of reads([w.roots, w.others]))
+        for (const d of p.datas)
+            if (r.map === sizeMap(d.name))
+                shape(r.key, d);
     if (w.depth >= 2)
         for (const r of [...all])
             for (const d of p.datas)
@@ -1045,6 +1968,9 @@ function instancesOf(p, fs, w) {
     for (const d of used.values())
         if (!w.every || d.n >= w.models.length)
             inst(`cong ${d.map}`, d.at);
+    for (const q of [...insts])
+        note(reads(holdsAt(fs.facts[q.fact].name, q.at)));
+    ariths();
     lap(`congruences, ${insts.length} instances, ${w.models.length} models`);
     return insts;
 }
@@ -1163,11 +2089,10 @@ const dataTrace = !!globalThis.process?.env?.DATA_TRACE;
 // Debugging: every congruence a model's closure makes, not only those explanations use.
 const allCong = !!globalThis.process?.env?.DATA_ALLCONG;
 function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
-    const t0 = performance.now();
+    const t0 = clock();
     anchoredAt.clear();
     // A few models for the instances; the whole pool for the cases (a rare case gets its own models from it).
-    const models = pool.slice(0, 24), few = (ms) => ms.slice(0, 16);
-    const concl = encY(p, l.holds, new Map());
+    const few = (ms) => ms.slice(0, 16);
     const specs = [], where = new Map();
     for (const lm of lemmas) {
         const local = new Map();
@@ -1181,31 +2106,39 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
             specs.push({ ...n, uses: n.uses.map(u => ({ ...u, node: local.get(u.node) ?? u.node })) });
         });
     }
-    const me = specs.length, name = `${l.name}${scheme ? ` (${scheme.name})` : ''}`;
-    varSorts = new Map(l.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : [])));
-    const size = scheme?.on ? get(sizeMap(scheme.on.d.name), ev(scheme.on.v)) : k(0);
-    const rank = (sub) => [k(level), size, k(sub)];
-    const ih = (scheme?.uses ?? []).map(u => ({ node: me, subst: u.subst, guard: u.guard }));
-    const shapesAt = scheme?.on ? [ev(scheme.on.v)] : [];
-    const ihConcls = ih.map(u => substC(concl, { vars: u.subst, maps: {}, flags: {} }));
-    // Uses of the lemmas, where a lemma's largest read matches a read of this goal (unfolded), its key up to the equalities
-    // the unfolded definitions give (any branch); twice over, the uses' own conclusions read the second time.
-    const pre = instancesOf(p, fs, { roots: [concl], others: ihConcls, depth, shapesAt, etaAt: [], models: [], until: t0 + attemptMs.ms });
-    const lemmaUses = lemmaUsesFor(p, fs, lemmas.map(lm => ({ law: lm.law, node: where.get(lm.spec.name), concl: specs[where.get(lm.spec.name)].concl })), [concl, ihConcls], pre, models);
-    const uses = [...ih, ...lemmaUses];
-    if (dataTrace)
-        for (const u of lemmaUses)
-            console.error(`[data]   lemma use ${specs[u.node].name.slice(0, 40)} at ${Object.entries(u.subst).map(([x, t]) => `${x} := ${JSON.stringify(t).slice(0, 80)}`).join('; ')}`);
-    const useConcl = (u) => substC(u.node === me ? concl : specs[u.node].concl, { vars: u.subst, maps: {}, flags: {} });
-    // The lemmas' conclusions are unfolded like the law's (they are what the goal reads, said another way); the cycle's
-    // own uses only from depth 3.
-    const instsFor = (ms, us, every = false) => instancesOf(p, fs, { roots: [concl], others: us.map(useConcl), depth, shapesAt, etaAt: [...shapesAt, ...valuesCompared(p, l)], models: ms, every, until: t0 + attemptMs.ms });
-    const cases = scheme ? casesOf(p, pre.filter(q => fs.facts[q.fact].name.startsWith('fn ')).map(q => holdsAt(fs, q)), new Set(l.vars.map(v => v.name)), pool) : [];
-    if (cases.length <= 1) {
-        specs.push({ name, hyps: [], concl, rank: rank(0), insts: instsFor(models, uses), uses });
-    }
-    else {
-        specs.push({ name, hyps: [], concl, rank: rank(1), insts: [], uses: cases.map((c, i) => ({ node: me + 1 + i, subst: {}, guard: andC(yesC, ...c.lits) })) });
+    // The scheme's nodes: the law's, then each companion's (a mutual induction), each its own models. A use of member i
+    // reads node -1 - i until the nodes are placed.
+    const members = [{ law: l, on: scheme?.on, uses: scheme?.uses ?? [], pool, rank: scheme?.rank, shapes: scheme?.shapes }, ...(scheme?.companions ?? []).map(c => ({ ...c, pool: modelsFor(p, c.law, pool.length, 5) }))];
+    const concls = members.map(mb => encY(p, mb.law.holds, new Map()));
+    const base = specs.length, title = `${l.name}${scheme ? ` (${scheme.name})` : ''}`;
+    varSorts = new Map(members.flatMap(mb => mb.law.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : []))));
+    const lemmaNodes = lemmas.map(lm => ({ law: lm.law, node: where.get(lm.spec.name), concl: specs[where.get(lm.spec.name)].concl }));
+    const useConcl = (u) => substC(u.node < 0 ? concls[-1 - u.node] : specs[u.node].concl, { vars: u.subst, maps: {}, flags: {} });
+    const plans = [];
+    for (const [mi, mb] of members.entries()) {
+        const models = mb.pool.slice(0, 24), concl = concls[mi], name = mi === 0 ? title : `${title}, at ${mb.on.d.name}`;
+        const ih = mb.uses.map(u => ({ node: -1 - (u.member ?? mi), subst: u.subst, guard: u.guard }));
+        const shapesAt = mb.rank ? rankShapes(mb.shapes ?? [], mb.rank, mb.uses) : mb.on && mb.on.d !== 'nat' ? [ev(mb.on.v)] : [];
+        const ihConcls = ih.map(useConcl);
+        // Uses of the lemmas, where a lemma's largest read matches a read of this goal (unfolded), its key up to the
+        // equalities the unfolded definitions give (any branch); twice over, the uses' own conclusions read the second time.
+        const pre = instancesOf(p, fs, { roots: [concl], others: ihConcls, depth, shapesAt, etaAt: [], models: [], until: t0 + attemptMs.ms });
+        const lemmaUses = lemmaUsesFor(p, fs, lemmaNodes, [concl, ihConcls], pre, models);
+        const uses = [...ih, ...lemmaUses];
+        if (dataTrace)
+            for (const u of lemmaUses)
+                console.error(`[data]   lemma use ${specs[u.node].name.slice(0, 40)} at ${Object.entries(u.subst).map(([x, t]) => `${x} := ${JSON.stringify(t).slice(0, 80)}`).join('; ')}`);
+        // The lemmas' conclusions are unfolded like the law's (they are what the goal reads, said another way); the cycle's
+        // own uses only from depth 3.
+        const instsFor = (ms, us, every = false) => instancesOf(p, fs, { roots: [concl], others: us.map(useConcl), depth, shapesAt, etaAt: [...shapesAt, ...valuesCompared(p, mb.law)], models: ms, every, until: t0 + attemptMs.ms });
+        const cases = scheme ? casesOf(p, pre.filter(q => fs.facts[q.fact].name.startsWith('fn ')).map(q => holdsAt(fs, q)), new Set(mb.law.vars.map(v => v.name)), mb.pool) : [];
+        if (cases.length <= 1) {
+            // One node: four uses of a lemma, twelve in all, the best first (as lemmaUsesFor ranks them).
+            const one = capUses(uses, 12);
+            plans.push([{ name, hyps: [], concl, sub: 0, insts: instsFor(models, one), uses: one }]);
+            continue;
+        }
+        const plan = [{ name, hyps: [], concl, sub: 1, insts: [], uses: [], cases: cases.map(c => andC(yesC, ...c.lits)) }];
         for (const [i, c] of cases.entries()) {
             // The uses whose guard some model of the case meets (all, for a case no model reaches).
             const holdsIn = (g) => !c.models || c.models.some(({ m, env }) => { try {
@@ -1221,26 +2154,42 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
             catch {
                 return false;
             } }); };
-            const us = uses.filter(u => holdsIn(u.guard) && applies(u));
+            const us = capUses(uses.filter(u => holdsIn(u.guard) && applies(u)));
             const ms = few(c.models ?? c.near ?? models);
-            specs.push({ name: `${name}, case ${i + 1}`, hyps: c.lits, concl, rank: rank(0), insts: reached(p, fs, instsFor(ms, us), [c.lits, concl, us.map(u => [u.guard, useConcl(u)]), shapesAt], ms), uses: us });
+            plan.push({ name: `${name}, case ${i + 1}`, hyps: c.lits, concl, sub: 0, insts: reached(p, fs, instsFor(ms, us), [c.lits, concl, us.map(u => [u.guard, useConcl(u)]), shapesAt], ms), uses: us });
         }
+        plans.push(plan);
+    }
+    // Placed: each member's node, then its cases; a main node with cases uses them, at rank (level, size, 1) above theirs.
+    const offsets = plans.map((_, i) => base + plans.slice(0, i).reduce((n, q) => n + q.length, 0));
+    for (const [mi, plan] of plans.entries()) {
+        const mb = members[mi], size = !mb.on ? k(0) : mb.on.d === 'nat' ? ev(mb.on.v) : get(sizeMap(mb.on.d.name), ev(mb.on.v));
+        // (level, the measure or the size, 0 or 1), the measure's place padded to the program's widest measure
+        const comps = mb.rank ?? [size], mid = [...comps, ...Array.from({ length: rankWidth(p) - comps.length }, () => k(0))];
+        for (const { sub, cases, ...n } of plan)
+            specs.push({ ...n, rank: [k(level), ...mid, k(sub)], uses: cases ? cases.map((g, i) => ({ node: offsets[mi] + 1 + i, subst: {}, guard: g })) : n.uses.map(u => (u.node < 0 ? { ...u, node: offsets[-1 - u.node] } : u)) });
     }
+    const name = title;
     // Each attempt within its own time (a goal past it is left unknown, and the attempt fails).
     if (dataTrace)
-        console.error(`[data] @${Math.round(performance.now())} ${l.name} (${scheme?.name}) depth ${depth}, ${lemmas.length} lemmas: built in ${Math.round(performance.now() - t0)} ms, ${specs.length} nodes, ${specs.reduce((n, x) => n + x.insts.length, 0)} instances`);
-    if (performance.now() > t0 + attemptMs.ms)
-        return { verdict: { proven: false, checked: false, node: name, goal: name, stuck: 'unknown' }, specs };
+        console.error(`[data] @${Math.round(performance.now())} ${l.name} (${scheme?.name}) depth ${depth}, ${lemmas.length} lemmas: built in ${Math.round(clock() - t0)} ms (counted), ${specs.length} nodes, ${specs.reduce((n, x) => n + x.insts.length, 0)} instances`);
+    if (clock() > t0 + attemptMs.ms)
+        return { verdict: { proven: false, checked: false, node: name, goal: name, stuck: 'unknown' }, specs, main: base };
     const was = pairedKeys.skip;
     pairedKeys.skip = true;
     try {
-        return { verdict: withDeadline(t0 + attemptMs.ms, () => proveCyclic(fs.facts, specs)), specs };
+        return { verdict: withDeadline(t0 + attemptMs.ms, () => proveCyclic(fs.facts, specs)), specs, main: base };
     }
     finally {
         pairedKeys.skip = was;
     }
 }
 export const attemptMs = { ms: 8000 };
+// A datatype search's budgets count work, not wall time (kernel/prove.ts's `counted`: the solver's rows and each node's),
+// 300 units a millisecond: a search finds the same proof on any machine, at any load. On Modal (2 vCPU) the corpus's
+// searches do 50 to 263 units a millisecond (`runs/modal/cover/data3`, data-cal), so a budget lets each do at least the
+// work it did there in wall time.
+const dataRate = 300;
 // A case node's instances, those its models reach: from every read of its conclusion and its uses' (and their guards),
 // through each instance at a read reached (a function's at its call, a constructor's at its cell, a shape or eta at a
 // value whose tag is read), the reads of what it gives where the models take it (an if's taken branch, an implication's
@@ -1292,6 +2241,12 @@ function reached(p, fs, insts, from, ms) {
             return [get(name.slice(3), keyOf(q.at))];
         if (name.startsWith('ctor '))
             return [get(name.slice(5), keyOf(q.at))];
+        if (name.startsWith('arith ')) {
+            const k2 = Number(name.slice(6));
+            return [get(divMap(k2), q.at[0]), get(modMap(k2), q.at[0])];
+        }
+        if (name === 'zcode')
+            return [get(posMap, q.at[0]), get(negMap, q.at[0])];
         if (name.startsWith('shape ') || name.startsWith('eta ')) {
             const d = name.split(' ')[1];
             return [get(tagMap(d), q.at[0]), get(sizeMap(d), q.at[0]), ...p.datas.filter(x => x.name === d).flatMap(x => x.ctors.flatMap((c, j) => c.fields.map((_, i) => get(fieldMap(x, j, i), q.at[0]))))];
@@ -1386,6 +2341,7 @@ function lemmaUsesFor(p, fs, lemmas, from, insts, models = []) {
         reads.push(o); });
     for (let round = 0; round < 2; round++) {
         const fresh = [];
+        const cands = [];
         // The newest lemma first (the one the law is tried again for).
         for (const lm of [...lemmas].reverse()) {
             if (round > 0 && out.some(u => u.node === lm.node))
@@ -1410,28 +2366,70 @@ function lemmaUsesFor(p, fs, lemmas, from, insts, models = []) {
                             continue;
                         // Where a model gives the lemma's arguments the goal read's (a match through every branch's classes may be none).
                         const there = pats.map(a => substE(a, { vars: sub, maps: {}, flags: {} }));
-                        if (models.length && !models.some(({ m, env }) => { try {
+                        const score = models.length ? models.filter(({ m, env }) => { try {
                             return there.every((a, q) => m.evalE(a, env) === m.evalE(args[q], env));
                         }
                         catch {
                             return false;
-                        } }))
+                        } }).length : 1;
+                        if (!score)
                             continue;
                         const k2 = JSON.stringify([lm.node, sub]);
-                        if (seen.has(k2) || out.length >= 12 || out.filter(u => u.node === lm.node).length >= 4)
+                        if (seen.has(k2))
                             continue;
                         seen.add(k2);
-                        out.push({ node: lm.node, subst: sub, guard: yesC });
-                        matchedAt.set(out.at(-1), { goal: t, lemma: substE(top, { vars: sub, maps: {}, flags: {} }) });
-                        walk(substC(lm.concl, { vars: sub, maps: {}, flags: {} }), o => { if (o.op === 'get')
-                            fresh.push(o); });
+                        const names = Object.keys(sub).sort();
+                        const fp = models.length ? JSON.stringify([lm.node, models.map(({ m, env }) => names.map(x => { try {
+                                return m.evalE(sub[x], env);
+                            }
+                            catch {
+                                return -1;
+                            } }))]) : k2;
+                        cands.push({ use: { node: lm.node, subst: sub, guard: yesC }, at: { goal: t, lemma: substE(top, { vars: sub, maps: {}, flags: {} }) }, score, fp, size: k2.length });
                     }
                 }
         }
+        // First, as found: four of a lemma, twelve in all (the next round reads their conclusions). Then the rest, best first
+        // (the most models, then the smallest terms), one of each set of values, up to `perLemma` of a lemma and `total` in
+        // all: a case node keeps those its models meet, `perCase` of a lemma (attempt's `applies`), so a use that holds in
+        // one case only (the insertion's other side) isn't crowded out by those found first.
+        const fps = new Set(), first = new Set();
+        const take = (c) => { fps.add(c.fp); out.push(c.use); matchedAt.set(c.use, c.at); };
+        for (const c of cands) {
+            if (out.length >= 12 || out.filter(u => u.node === c.use.node).length >= 4)
+                continue;
+            take(c);
+            first.add(c);
+            walk(substC(lemmas.find(lm => lm.node === c.use.node).concl, { vars: c.use.subst, maps: {}, flags: {} }), o => { if (o.op === 'get')
+                fresh.push(o); });
+        }
+        const rest = cands.filter(c => !first.has(c)).sort((a, b) => b.score - a.score || a.size - b.size);
+        for (const c of rest)
+            if (!fps.has(c.fp) && out.length < lemmaCaps.total && out.filter(u => u.node === c.use.node).length < lemmaCaps.perLemma)
+                take(c);
         reads = fresh;
     }
     return out;
 }
+// How many uses of lemmas a goal gets: the candidates kept (`perLemma` of each lemma, `total`), and of those a case node
+// keeps (`perCase` of each lemma, those its models meet).
+export const lemmaCaps = { perLemma: 8, total: 24, perCase: 4 };
+// A node's uses: the scheme's (the cycle's, read at nodes not yet placed) all, `perCase` of each lemma, `total` lemma
+// uses in all, in the order given.
+function capUses(uses, total = Infinity) {
+    const per = new Map();
+    let all = 0;
+    return uses.filter(u => {
+        if (u.node < 0)
+            return true;
+        const n = per.get(u.node) ?? 0;
+        if (n >= lemmaCaps.perCase || all >= total)
+            return false;
+        per.set(u.node, n + 1);
+        all++;
+        return true;
+    });
+}
 // The equalities a condition may give: those in a positive place (a conjunction's parts, a disjunction's disjuncts that
 // aren't negations, so an implication's conclusion and never its premise).
 function equalities(c) {
@@ -1453,19 +2451,23 @@ function modelsFor(p, l, n, seed) {
     });
 }
 // Prove a law with the lemmas given (each proven, with its nodes), trying each scheme at each depth.
-function proveWith(p, fs, l, lemmas, level, opts, until, per, depths) {
+// `without`: 'plain', the law with no induction where no scheme applies; 'cases', no induction, then by the cases of
+// each variable (a natural's zero and successor, a datatype's constructors), none of them using the law again.
+function proveWith(p, fs, l, lemmas, level, opts, until, per, depths, without) {
     const models = modelsFor(p, l, 240, opts.seed ?? 3);
     let tried = 0, last;
-    const ss = opts.induction === false ? [undefined] : schemes(p, l);
+    const cases = l.vars.flatMap((v) => (v.sort === 'nat' || v.sort instanceof Data ? [{ name: `cases of ${v.name}`, on: { v: v.name, d: v.sort }, uses: [] }] : []));
+    const found = opts.induction === false || without === 'cases' ? [] : schemes(p, l);
+    const ss = opts.induction === false ? [undefined] : without === 'cases' ? [undefined, ...cases] : without === 'plain' && !found.length ? [undefined] : found;
     for (const depth of depths.filter(d => d <= (opts.depth ?? 3)))
         for (const s of ss) {
-            if (performance.now() > until)
+            if (clock() > until)
                 return { tried, last };
             tried++;
-            const { verdict, specs } = (attemptMs.ms = Math.min(per * (opts.patience ?? 1), until - performance.now()), attempt(p, fs, l, s, depth, lemmas, level, models));
+            const { verdict, specs, main } = (attemptMs.ms = Math.min(per * (opts.patience ?? 1), until - clock()), attempt(p, fs, l, s, depth, lemmas, level, models));
             last = verdict;
             if (verdict.proven && verdict.checked)
-                return { out: { law: l, spec: specs.find(n => n.name === specs[specs.length - 1].name.replace(/, case \d+$/, '')), nodes: specs }, verdict, scheme: s?.name, tried };
+                return { out: { law: l, spec: specs[main], nodes: specs }, verdict, scheme: s?.name ?? (without ? 'no induction' : undefined), tried };
         }
     return { tried, last };
 }
@@ -1527,7 +2529,7 @@ export function conjectures(p, l, max = 24, maxSize = 6) {
                 addT({ x: { op: 'call', fn: f.name, args: args.map(a => a.x) }, sort: f.ret, size });
         for (const d of p.datas)
             d.ctors.forEach((c, j) => { if (c.fields.length)
-                for (const args of build(c.fields.map(f => (f.sort === 'nat' ? 'nat' : d)), size - 1))
+                for (const args of build(c.fields.map(f => fieldSort(f)), size - 1))
                     addT({ x: { op: 'ctor', data: d.name, ctor: j, args: args.map(a => a.x) }, sort: d, size }); });
         for (const [a2, b2] of build(['nat', 'nat'], size - 1))
             if (JSON.stringify(a2.x) <= JSON.stringify(b2.x))
@@ -1641,8 +2643,10 @@ export function conjectures(p, l, max = 24, maxSize = 6) {
     const kept = [];
     // The definitions, unfolded at a constructor: f(.., C(x, y), ..) → its case's body, where that is a plain term.
     for (const f of fnsUsed) {
-        const body = f.body(), di = f.decreases;
-        if (body.op !== 'match' || di === undefined || body.of.op !== 'var' || body.of.name !== `${f.name}.${f.params[di].name}`)
+        // (a structural function's decreasing parameter, a well-founded one's the body matches on first)
+        const body = f.body(), top = body.op === 'match' && body.of.op === 'var' ? f.params.findIndex(q => `${f.name}.${q.name}` === body.of.name) : -1;
+        const di = f.decreases ?? (f.measure ? top : -1);
+        if (body.op !== 'match' || di < 0 || di !== top)
             continue;
         const d = f.params[di].sort;
         body.cases.forEach((c, j) => {
@@ -1745,15 +2749,28 @@ export const showX = (x) => {
         case 'min':
         case 'max': return `${x.op}(${showX(x.a)}, ${showX(x.b)})`;
         case 'mul': return `${x.k}·${showX(x.a)}`;
+        case 'prod': return `${showX(x.a)}·${showX(x.b)}`;
+        case 'mod':
+        case 'imod': return `${showX(x.a)} mod ${x.k}`;
+        case 'div':
+        case 'idiv': return `${showX(x.a)} div ${x.k}`;
+        case 'int': return String(x.value);
+        case 'iadd': return `${showX(x.a)} + ${showX(x.b)}`;
+        case 'isub': return `${showX(x.a)} − ${showX(x.b)}`;
+        case 'ineg': return `−${showX(x.a)}`;
+        case 'imul': return `${x.k}·${showX(x.a)}`;
+        case 'ofnat': return showX(x.a);
         case 'if': return `if ${showY(x.c)} then ${showX(x.then)} else ${showX(x.else)}`;
         case 'bool': return showY(x.c);
         case 'apply': return `${x.param}(${showX(x.arg)})`;
+        case 'size': return `size(${showX(x.of)})`;
         case 'call': return `${x.fn}(${x.args.map(showX).join(', ')})`;
         case 'ctor': {
             const d = [...fns.values()].length >= 0 ? x.data : x.data;
             return `${d}.${x.ctor}${x.args.length ? `(${x.args.map(showX).join(', ')})` : ''}`;
         }
         case 'match': return `match ${showX(x.of)}`;
+        case 'natmatch': return `match ${showX(x.of)}`;
     }
 };
 export const showY = (y) => {
@@ -1761,6 +2778,8 @@ export const showY = (y) => {
         case '<':
         case '<=':
         case '=': return `${showX(y.a)} ${y.op} ${showX(y.b)}`;
+        case 'i<':
+        case 'i<=': return `${showX(y.a)} ${y.op.slice(1)} ${showX(y.b)}`;
         case 'and': return y.xs.map(showY).join(' and ');
         case 'or': return y.xs.map(showY).join(' or ');
         case 'not': return `not (${showY(y.x)})`;
@@ -1771,16 +2790,49 @@ export const showY = (y) => {
 // Prove a law over datatypes: refuted by a random value where one breaks it; else proven by a cycle the search finds,
 // with lemmas found from the values when the law alone isn't (`lemmas: false` turns that off; an array gives lemmas to
 // prove and use instead, which the corpus never does).
-export function proveData(l, opts = {}) {
-    const t0 = performance.now(), until = t0 + (opts.ms ?? 120_000);
-    const p = programOf([l, ...(Array.isArray(opts.lemmas) ? opts.lemmas : [])]), fs = factsOf(p);
-    const done = (v) => ({ law: l.name, ...v, ms: Math.round(performance.now() - t0) });
-    const cex = refute(l, opts.samples ?? 400);
-    if (cex)
-        return done({ proven: false, checked: false, counterexample: cex, lemmas: [], tried: 0 });
+export function proveData(l, opts = {}) { return counted(dataRate, () => bounded(() => proveDataCounted(l, opts))); }
+function proveDataCounted(l, opts) {
+    const t0 = performance.now(), until = clock() + (opts.ms ?? 120_000);
+    // Where the law calls a non-recursive function, or reaches a recursive one that agrees with a built-in (core/transfer.ts):
+    // the law alone at one unfolding first, then the law said through them, then the rest of the search on the law.
+    const plan = opts.transfer === false || opts.induction === false || Array.isArray(opts.lemmas) ? undefined : transferPlan(l);
+    if (!plan)
+        return searchIn(l, opts, until).verdict;
+    const quick = searchIn(l, opts, until, undefined, 'first').verdict;
+    if (quick.proven || quick.counterexample)
+        return quick;
+    // (a law said through its definitions past what the encoding's terms take is left as stated)
+    let through;
+    try {
+        through = proveThrough(l, plan, opts, until);
+    }
+    catch (e) {
+        if (!(e instanceof RangeError))
+            throw e;
+    }
+    if (through?.proven)
+        return { ...through, ms: Math.round(performance.now() - t0) };
+    const rest = searchIn(l, opts, until, undefined, 'rest').verdict;
+    return { ...rest, tried: rest.tried + quick.tried + (through?.tried ?? 0), ms: Math.round(performance.now() - t0), ...(rest.goal || rest.proven ? {} : { goal: quick.goal, stuck: quick.stuck }) };
+}
+export function searchIn(l, opts, until, ctx, phase = 'all') {
+    const t0 = performance.now(), w0 = work.n;
+    const p = ctx?.p ?? programOf([l, ...(Array.isArray(opts.lemmas) ? opts.lemmas : [])]), fs = ctx?.fs ?? factsOf(p);
+    const base = ctx?.base ?? [], lv = ctx?.level ?? 0;
+    let out;
+    const done = (v) => {
+        if (dataTrace)
+            console.error(`[data] ${l.name}: ${work.n - w0} units of work in ${Math.round(performance.now() - t0)} ms`);
+        return { verdict: { law: l.name, ...v, ms: Math.round(performance.now() - t0) }, out };
+    };
+    if (phase !== 'rest') {
+        const cex = refute(l, opts.samples ?? 400);
+        if (cex)
+            return done({ proven: false, checked: false, counterexample: cex, lemmas: [], tried: 0 });
+    }
     // The law alone at one unfolding; then lemmas at one unfolding each (the law tried again after each its goal
-    // matches); then the law at two; then lemmas at two; last the law at three. A lemma is named in the verdict when the
-    // proof uses it.
+    // matches); then the law at two; then lemmas at two; last the law at three, and without induction (by cases). A lemma
+    // is named in the verdict when the proof uses it.
     let tried = 0;
     const used = (r, lemmas) => {
         const nodes = r.nodes, seen = new Set(), todo = [nodes.indexOf(r.spec)];
@@ -1794,34 +2846,49 @@ export function proveData(l, opts = {}) {
         }
         return lemmas.filter(q => seen.has(nodes.indexOf(nodes.find(n => n.name === q.spec.name)))).map(q => q.law.name);
     };
-    const ok = (r, lemmas, prog = p) => (tried += r.tried, r.out ? done({ proven: true, checked: true, proof: r.verdict, lemmas: used(r.out, lemmas), scheme: r.scheme, tried, program: prog, node: r.out.nodes.indexOf(r.out.spec) }) : undefined);
-    const first = proveWith(p, fs, l, [], 1, opts, until, 6000, [1]);
-    const one = ok(first, []);
+    const ok = (r, lemmas, prog = p) => (tried += r.tried, r.out ? (out = r.out, done({ proven: true, checked: true, proof: r.verdict, lemmas: used(r.out, lemmas), scheme: r.scheme, tried, program: prog, node: r.out.nodes.indexOf(r.out.spec) })) : undefined);
+    // A law that calls no function (arithmetic alone: an integer's, a remainder's) has nothing to induct on: its cases.
+    if (phase !== 'rest' && opts.induction !== false && !JSON.stringify(l.holds).includes('"op":"call"')) {
+        const c = ok(proveWith(p, fs, l, base, lv + 1, opts, until, 3000, [1, 2], 'cases'), base);
+        if (c)
+            return c;
+    }
+    const first = phase === 'rest' ? undefined : proveWith(p, fs, l, base, lv + 1, opts, until, 6000, [1], 'plain');
+    const one = first && ok(first, base);
     if (one)
         return one;
+    if (phase === 'first')
+        return done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
     const without = opts.lemmas === false || opts.induction === false;
     if (without)
-        return ok(proveWith(p, fs, l, [], 1, opts, until, 20000, [2, 3]), []) ?? done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
+        return ok(proveWith(p, fs, l, base, lv + 1, opts, until, 20000, [2, 3]), base) ?? (opts.induction === false ? undefined : ok(proveWith(p, fs, l, base, lv + 1, opts, until, 3000, [1, 2], 'cases'), base)) ?? done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first?.last) });
     const cands = Array.isArray(opts.lemmas) ? opts.lemmas : conjectures(p, l);
-    const p2 = programOf([l, ...cands]), fs2 = factsOf(p2);
-    const goalOf = (s) => {
-        const concl = encY(p2, l.holds, new Map()), ihc = (s?.uses ?? []).map(u => substC(concl, { vars: u.subst, maps: {}, flags: {} }));
-        return { from: [concl, ihc], insts: instancesOf(p2, fs2, { roots: [concl], others: ihc, depth: 2, shapesAt: s?.on ? [ev(s.on.v)] : [], etaAt: [], models: [] }) };
+    const p2 = ctx ? p : programOf([l, ...cands]), fs2 = ctx ? fs : factsOf(p2);
+    // Each scheme's goals: the law's, and each companion's (a lemma may be what only a companion's goal reads).
+    const goalOf = (law, uses, on, concls, shapes) => {
+        const concl = encY(p2, law.holds, new Map()), ihc = uses.map(u => substC(concls[u.member ?? 0] ?? concl, { vars: u.subst, maps: {}, flags: {} }));
+        return { from: [concl, ihc], insts: instancesOf(p2, fs2, { roots: [concl], others: ihc, depth: 2, shapesAt: shapes ?? (on && on.d !== 'nat' ? [ev(on.v)] : []), etaAt: [], models: [] }) };
     };
-    const goals = schemes(p2, l).map(goalOf);
+    const goals = schemes(p2, l).flatMap(s => {
+        const all = [{ law: l, uses: s.uses, on: s.on, shapes: s.shapes }, ...(s.companions ?? [])], concls = all.map(m => encY(p2, m.law.holds, new Map()));
+        return all.map((m, i) => goalOf(m.law, m.uses.map(u => ({ ...u, member: u.member ?? i })), m.on, concls, 'shapes' in m ? m.shapes : undefined));
+    });
     const matchesGoal = (c) => goals.some(g => lemmaUsesFor(p2, fs2, [{ law: c, node: 0, concl: encY(p2, c.holds, new Map()) }], g.from, g.insts).length > 0);
     // Those the goal matches first, of those the ones of the law's shape (an implication for an implication) first.
     const implication = (y) => y.op === 'or' && y.xs.length === 2 && y.xs[0].op === 'not';
     const score = (c, hit) => (hit ? 2 : 0) + (implication(c.holds) === implication(l.holds) ? 1 : 0);
+    if (dataTrace)
+        console.error(`[data] ${l.name}: ${cands.length} conjectures at ${Math.round(clock())} of ${Math.round(until)}`);
     const ranked = cands.map(c => ({ c, hit: matchesGoal(c) })).sort((a, b) => score(b.c, b.hit) - score(a.c, a.hit));
-    const proven = [], failed = new Set();
+    // The lemmas proven: those given (`base`) and those found, each found one a level above the last.
+    const proven = [...base], failed = new Set(), level = () => lv + 1 + proven.length - base.length;
     const lemmasAt = (depth) => {
         for (const { c, hit } of ranked) {
-            if (performance.now() > until)
+            if (clock() > until)
                 return undefined;
             if (proven.some(q => q.law === c) || (depth === 2 && !failed.has(c)) || refute(c, 200))
                 continue;
-            const r = proveWith(p2, fs2, c, proven, 1 + proven.length, opts, Math.min(until, performance.now() + (depth === 1 ? 8000 : 12000) * (opts.patience ?? 1)), 5000, [depth]);
+            const r = proveWith(p2, fs2, c, proven, level(), opts, Math.min(until, clock() + (depth === 1 ? 8000 : 12000) * (opts.patience ?? 1)), 5000, [depth]);
             tried += r.tried;
             if (!r.out) {
                 failed.add(c);
@@ -1831,7 +2898,7 @@ export function proveData(l, opts = {}) {
             proven.push(r.out);
             if (!hit && implication(c.holds) !== implication(l.holds))
                 continue;
-            const again = ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 6000, depth === 1 ? [1] : [1, 2]), proven, p2);
+            const again = ok(proveWith(p2, fs2, l, proven, level(), opts, until, 6000, depth === 1 ? [1] : [1, 2]), proven, p2);
             if (again)
                 return again;
         }
@@ -1839,19 +2906,23 @@ export function proveData(l, opts = {}) {
     };
     const steps = [
         () => lemmasAt(1),
-        () => ok(proveWith(p, fs, l, [], 1, opts, until, 30000, [2]), []),
-        () => (proven.length ? ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 30000, [2]), proven, p2) : undefined),
+        () => ok(proveWith(p, fs, l, base, lv + 1, opts, until, 30000, [2]), base),
+        () => (proven.length > base.length ? ok(proveWith(p2, fs2, l, proven, level(), opts, until, 30000, [2]), proven, p2) : undefined),
         () => lemmasAt(2),
-        () => ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 12000, [3]), proven, p2),
+        () => ok(proveWith(p2, fs2, l, proven, level(), opts, until, 12000, [3]), proven, p2),
+        // No induction: the law by the cases of a variable (or none), its definitions unfolded.
+        () => ok(proveWith(p, fs, l, base, lv + 1, opts, until, 3000, [1, 2], 'cases'), base),
     ];
-    for (const step of steps) {
-        if (performance.now() > until)
+    for (const [i, step] of steps.entries()) {
+        if (clock() > until)
             break;
-        const out = step();
-        if (out)
-            return out;
+        if (dataTrace)
+            console.error(`[data] ${l.name}: step ${i} at ${Math.round(clock())} of ${Math.round(until)}`);
+        const r = step();
+        if (r)
+            return r;
     }
-    return done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
+    return done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first?.last) });
 }
 const stuckOf = (v) => (v && !v.proven ? { goal: v.goal, stuck: v.stuck } : v && !v.checked ? { goal: 'check', stuck: v.why } : {});
 // The law with no cycle: its definitions unfolded, the kernel's prover alone (what the library proves without the search).