gdp-wired 0.20.0 → 0.21.0

package/dist/core/data.js

@@ -2,13 +2,21 @@ import { substC, substE } from "../kernel/kernel.js";
 import { proveCyclic } from "./cyclic.js";
 import { clock, counted, pairedKeys, withDeadline } from "../kernel/prove.js";
 import { work } from "./solver.js";
+import { ranksOfRuns } from "./cycles.js";
+import { proveThrough, transferPlan } from "./transfer.js";
 // --- sorts and the AST ------------------------------------------------------------------------------------------------
 export const self = { self: true };
 export const natural = 'nat';
 export const boolean = 'bool';
+// A signed integer (Lean's Int): opt-in, beside the naturals, whose truncated subtraction keeps its meaning. Encoded as
+// its zigzag code (z ↦ 2z for z ≥ 0, −2z − 1 below), a bijection with the naturals like a datatype's, so a value is one
+// natural and two values are equal exactly when their codes are; its arithmetic reads a code as two naturals, p − n
+// (from the code's quotient and remainder by 2), and writes the result's code back (`encI`, `codeOfPair`).
+export const integer = 'int';
+export const isDataField = (s) => typeof s === 'object';
 // --- the surface ------------------------------------------------------------------------------------------------------
 let fresh = 0;
-const bindName = (field) => `${field}#${++fresh}`;
+export const bindName = (field) => `${field}#${++fresh}`;
 export class Nat {
     x;
     constructor(x) {
@@ -17,6 +25,11 @@ export class Nat {
     plus(b) { return new Nat({ op: 'add', a: this.x, b: natX(b) }); }
     minus(b) { return new Nat({ op: 'sub', a: this.x, b: natX(b) }); }
     times(k) { return new Nat({ op: 'mul', k, a: this.x }); }
+    // A product of two naturals (the kernel multiplies it out; nonlinear: what proves it is products of facts and squares).
+    mul(b) { return new Nat({ op: 'prod', a: this.x, b: natX(b) }); }
+    modBy(k) { return new Nat({ op: 'mod', k: divisorOf(k), a: this.x }); }
+    divBy(k) { return new Nat({ op: 'div', k: divisorOf(k), a: this.x }); }
+    toInt() { return new Integer({ op: 'ofnat', a: this.x }); }
     lt(b) { return new Bool({ op: '<', a: this.x, b: natX(b) }); }
     atMost(b) { return new Bool({ op: '<=', a: this.x, b: natX(b) }); }
     gt(b) { return new Bool({ op: '<', a: natX(b), b: this.x }); }
@@ -27,12 +40,41 @@ export class Nat {
     // oxlint-disable-next-line typescript/no-explicit-any
     match(cases) {
         const pred = bindName('pred'), zero = cases.zero(), succ = cases.succ({ pred: new Nat({ op: 'var', name: pred }) });
-        const body = (o) => (typeof o === 'number' ? natX(o) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
+        const int = zero instanceof Integer || succ instanceof Integer;
+        const body = (o) => (typeof o === 'number' ? (int ? intX(o) : natX(o)) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
         const x = { op: 'natmatch', of: this.x, zero: body(zero), pred, succ: body(succ) };
-        return (zero instanceof Bool ? new Bool({ op: 'holds', x }) : zero instanceof Val ? new Val(zero.data, x) : new Nat(x));
+        return (zero instanceof Bool ? new Bool({ op: 'holds', x }) : zero instanceof Val ? new Val(zero.data, x) : int ? new Integer(x) : new Nat(x));
     }
 }
 const natX = (t) => (typeof t === 'number' ? { op: 'nat', value: t } : t.x);
+const divisorOf = (k) => { if (!Number.isSafeInteger(k) || k < 1)
+    throw new RangeError(`a divisor is a whole number at least 1, not ${k}`); return k; };
+// An integer's term; a number is a literal (any sign).
+export class Integer {
+    x;
+    constructor(x) {
+        this.x = x;
+    }
+    plus(b) { return new Integer({ op: 'iadd', a: this.x, b: intX(b) }); }
+    minus(b) { return new Integer({ op: 'isub', a: this.x, b: intX(b) }); }
+    negate() { return new Integer({ op: 'ineg', a: this.x }); }
+    times(k) { if (!Number.isSafeInteger(k))
+        throw new RangeError(`${k} is not an integer`); return new Integer({ op: 'imul', k, a: this.x }); }
+    modBy(k) { return new Integer({ op: 'imod', k: divisorOf(k), a: this.x }); }
+    divBy(k) { return new Integer({ op: 'idiv', k: divisorOf(k), a: this.x }); }
+    lt(b) { return new Bool({ op: 'i<', a: this.x, b: intX(b) }); }
+    atMost(b) { return new Bool({ op: 'i<=', a: this.x, b: intX(b) }); }
+    gt(b) { return new Bool({ op: 'i<', a: intX(b), b: this.x }); }
+    atLeast(b) { return new Bool({ op: 'i<=', a: intX(b), b: this.x }); }
+    eq(b) { return new Bool({ op: '=', a: this.x, b: intX(b) }); }
+    ne(b) { return this.eq(b).not(); }
+}
+// An integer function's result: a natural literal in a branch (a match's case, an if's arm) is the integer's.
+const intResult = (x) => (x.op === 'nat' ? { op: 'int', value: x.value } : x.op === 'if' ? { ...x, then: intResult(x.then), else: intResult(x.else) }
+    : x.op === 'match' ? { ...x, cases: x.cases.map(c => ({ ...c, body: intResult(c.body) })) } : x.op === 'natmatch' ? { ...x, zero: intResult(x.zero), succ: intResult(x.succ) } : x);
+const intX = (t) => { if (typeof t !== 'number')
+    return t.x; if (!Number.isSafeInteger(t))
+    throw new RangeError(`${t} is not an integer`); return { op: 'int', value: t }; };
 export class Bool {
     y;
     constructor(y) {
@@ -66,23 +108,28 @@ export class Val {
             return { binds, out: f(fields) };
         });
         const first = built[0].out;
-        const body = (o) => (typeof o === 'number' ? natX(o) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
+        // A case that is an integer makes every case's number an integer's literal.
+        const int = built.some(b => b.out instanceof Integer);
+        const body = (o) => (typeof o === 'number' ? (int ? intX(o) : natX(o)) : o instanceof Bool ? { op: 'bool', c: o.y } : o.x);
         const x = { op: 'match', data: d.name, of: this.x, cases: built.map(b => ({ binds: b.binds, body: body(b.out) })) };
-        return (first instanceof Bool ? new Bool({ op: 'holds', x }) : first instanceof Val ? new Val(first.data, x) : new Nat(x));
+        return (first instanceof Bool ? new Bool({ op: 'holds', x }) : first instanceof Val ? new Val(first.data, x) : int ? new Integer(x) : new Nat(x));
     }
     is(ctor) { return new Bool({ op: 'is', data: this.data.name, of: this.x, ctor: this.data.index(ctor) }); }
+    // Its size: 1 plus the sizes of its fields of its datatype's group (a list's length plus 1, a tree's nodes and leaves).
+    size() { return new Nat({ op: 'size', data: this.data.name, of: this.x }); }
     eq(b) { return new Bool({ op: '=', a: this.x, b: b.x }); }
     ne(b) { return this.eq(b).not(); }
 }
 // A value of a sort from its term.
-export const wrap = (s, x) => (s === 'nat' ? new Nat(x) : s === 'bool' ? new Bool({ op: 'holds', x }) : new Val(s, x));
-const xOf = (s, v) => (s === 'nat' ? natX(v) : s === 'bool' ? { op: 'bool', c: v.y } : v.x);
+export const wrap = (s, x) => (s === 'nat' ? new Nat(x) : s === 'bool' ? new Bool({ op: 'holds', x }) : s === 'int' ? new Integer(x) : new Val(s, x));
+const xOf = (s, v) => (s === 'nat' ? natX(v) : s === 'bool' ? { op: 'bool', c: v.y } : s === 'int' ? intX(v) : v.x);
 export function when(c, a, b) {
     if (a instanceof Bool)
         return new Bool({ op: 'or', xs: [{ op: 'and', xs: [c.y, a.y] }, { op: 'and', xs: [{ op: 'not', x: c.y }, b.y] }] });
-    const ax = typeof a === 'number' ? natX(a) : a.x, bx = typeof b === 'number' ? natX(b) : b.x;
+    const int = a instanceof Integer || b instanceof Integer, lit = (t) => (int ? intX(t) : natX(t));
+    const ax = typeof a === 'number' ? lit(a) : a.x, bx = typeof b === 'number' ? lit(b) : b.x;
     const x = { op: 'if', c: c.y, then: ax, else: bx };
-    return (a instanceof Val ? new Val(a.data, x) : new Nat(x));
+    return (a instanceof Val ? new Val(a.data, x) : int ? new Integer(x) : new Nat(x));
 }
 // A datatype: its constructors, each with fields that are naturals or values of a datatype (`self`, another of its group,
 // or one declared before it). Its constructors are ordered as Lean's bijection numbers them: those of no field, then
@@ -92,8 +139,8 @@ let declaredSeq = 0;
 export const dataNamed = (name) => { const d = declared.get(name); if (!d)
     throw new Error(`no datatype ${name}`); return d; };
 // A field's sort; whether it is of the datatype's group (the fields its size counts, and an induction descends into).
-export const fieldSort = (f) => (f.sort === 'nat' ? 'nat' : dataNamed(f.sort.data));
-export const inGroup = (d, f) => f.sort !== 'nat' && d.group.includes(f.sort.data);
+export const fieldSort = (f) => (f.sort === 'nat' || f.sort === 'int' ? f.sort : dataNamed(f.sort.data));
+export const inGroup = (d, f) => isDataField(f.sort) && d.group.includes(f.sort.data);
 export class Data {
     name;
     group;
@@ -107,9 +154,9 @@ export class Data {
         const all = Object.entries(decl).map(([c, fs]) => ({ name: c, fields: Object.entries(fs).map(([f, s]) => ({ name: f, sort: s })) }));
         for (const c of all)
             for (const f of c.fields)
-                if (f.sort !== 'nat' && !group.includes(f.sort.data) && !declared.has(f.sort.data))
+                if (isDataField(f.sort) && !group.includes(f.sort.data) && !declared.has(f.sort.data))
                     throw new Error(`${name}.${c.name}.${f.name}: no datatype ${f.sort.data}`);
-        const rank = (c) => (!c.fields.length ? 0 : c.fields.every(f => !(f.sort !== 'nat' && group.includes(f.sort.data))) ? 1 : 2);
+        const rank = (c) => (!c.fields.length ? 0 : c.fields.every(f => !(isDataField(f.sort) && group.includes(f.sort.data))) ? 1 : 2);
         this.ctors = [...all].sort((a, b) => rank(a) - rank(b));
         declared.set(name, this);
     }
@@ -133,7 +180,7 @@ function groupHeights(group) {
         changed = false;
         for (const n of group)
             for (const c of dataNamed(n).ctors) {
-                const v = c.fields.reduce((m, f) => (f.sort !== 'nat' && group.includes(f.sort.data) ? Math.max(m, 1 + h.get(f.sort.data)) : m), 0);
+                const v = c.fields.reduce((m, f) => (isDataField(f.sort) && group.includes(f.sort.data) ? Math.max(m, 1 + h.get(f.sort.data)) : m), 0);
                 if (v < h.get(n)) {
                     h.set(n, v);
                     changed = true;
@@ -170,7 +217,7 @@ export function weakOrder(ds) {
         busy.add(d.name);
         const o = 1 + Math.max(0, ...d.ctors.flatMap(c => c.fields.flatMap(f => (inGroup(d, f) && f.sort.data !== d.name ? [visit(dataNamed(f.sort.data))] : []))));
         busy.delete(d.name);
-        if (d.ctors.some(c => c.fields.some(f => f.sort !== 'nat' && f.sort.data === d.name)) && weak(d))
+        if (d.ctors.some(c => c.fields.some(f => isDataField(f.sort) && f.sort.data === d.name)) && weak(d))
             throw new Error(`${d.name}: no constructor of no field and its first constructor has a field of ${d.name}, which the bijection with the naturals doesn't take`);
         out.set(d.name, o);
         return o;
@@ -183,11 +230,13 @@ const normField = (own, group) => (s) => {
         return { data: own };
     if (s === 'nat' || (s && typeof s === 'object' && 'nat' in s))
         return 'nat';
+    if (s === 'int')
+        return 'int';
     if (s instanceof Data)
         return { data: s.name };
     if (typeof s === 'string' && group.includes(s))
         return { data: s };
-    throw new Error(`${own}: a field is natural, self, a datatype declared before, or a name of its group`);
+    throw new Error(`${own}: a field is natural, integer, self, a datatype declared before, or a name of its group`);
 };
 const withCtors = (d) => { for (const c of d.ctors)
     Object.defineProperty(d, c.name, c.fields.length ? { value: (...args) => d.make(c.name, ...args) } : { get: () => d.make(c.name) }); };
@@ -210,21 +259,35 @@ export function mutual(decls) {
     return Object.fromEntries(ds.map(d => [d.name, d]));
 }
 const fns = new Map();
-export function define(name, params, ret, body) {
+export function define(name, params, ret, body, opts = {}) {
     if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
         throw new Error(`${name}: a function's name is letters and digits`);
     const ps = Object.entries(params).map(([n, s]) => ({ name: n, sort: s }));
-    let built, rec;
-    const fn = { name, params: ps, ret, paramFns: [], body: () => {
+    const stated = opts.measure && measureOf(name, ps, opts.measure);
+    let built, rec, failed;
+    // The recursion, checked once (a refusal kept and given again).
+    const got = () => {
+        if (failed)
+            throw failed;
+        try {
+            return (rec ??= recursion(fn));
+        }
+        catch (e) {
+            failed = e;
+            throw e;
+        }
+    };
+    const fn = { name, params: ps, ret, paramFns: [], stated, body: () => {
             if (!built) {
                 const args = Object.fromEntries(ps.map(p => [p.name, wrap(p.sort, { op: 'var', name: `${name}.${p.name}` })]));
-                built = xOf(ret, body(args));
+                built = ret === 'int' ? intResult(xOf(ret, body(args))) : xOf(ret, body(args));
                 fn.paramFns = [...new Set(paramsIn(built))];
                 walk(built, o => { if (o.op === 'call' && !fns.has(o.fn))
                     throw new Error(`${name} calls ${String(o.fn)}, which isn't defined`); });
             }
             return built;
-        }, get decreases() { return (rec ??= recursion(fn)).decreases; }, get ring() { return (rec ??= recursion(fn)).ring; }, set rec(r) { rec = r; } };
+        }, get decreases() { return got().decreases; }, get ring() { return got().ring; }, get measure() { return got().measure; }, get termination() { return got().termination; },
+        set rec(r) { rec = r; } };
     fns.set(name, fn);
     const call = (...args) => {
         if (args.length !== ps.length)
@@ -318,13 +381,318 @@ function recursion(fn) {
         }
         return undefined;
     };
-    const got = choose(0, []);
-    if (!got)
-        throw new Error(`${fn.name}: not structural recursion (no parameter whose field every recursive call passes${members.length > 1 ? `, in its ring ${members.map(f => f.name).join(', ')}` : ''})`);
+    const got = fn.stated ? undefined : choose(0, []);
+    if (!got) {
+        const why = `${fn.name}: not structural recursion (no parameter whose field every recursive call passes${members.length > 1 ? `, in its ring ${members.map(f => f.name).join(', ')}` : ''}${fn.stated ? '; a measure is given' : ''})`;
+        if (members.length > 1)
+            throw new Error(`${why}, and a ring of functions is taken by structural recursion only`);
+        const t = termination(fn, why);
+        return { ring: [fn.name], measure: t.measure, termination: t };
+    }
     const names = members.map(f => f.name);
     members.forEach((f, a) => { f.rec = { decreases: got[a], ring: names }; });
     return { decreases: got[0], ring: names };
 }
+export const terminationMs = { ms: 10_000 };
+const measurable = (s) => s === 'nat' || s instanceof Data;
+function measureOf(name, ps, m) {
+    if (!m.length)
+        throw new Error(`${name}: an empty measure`);
+    return { comps: m.map(c => {
+            const names = typeof c === 'string' ? [c] : c;
+            return { coef: ps.map(p => names.filter(n => n === p.name).length), c: names.every(n => ps.some(p => p.name === n && measurable(p.sort))) ? 0 : (() => { throw new Error(`${name}: a measure names its parameters of a datatype or naturals (${names.join(', ')})`); })() };
+        }) };
+}
+export const showMeasure = (f, m) => {
+    const comp = (c) => {
+        const parts = c.coef.flatMap((k, i) => (k ? [`${k < 0 ? '−' : ''}${Math.abs(k) === 1 ? '' : `${Math.abs(k)}·`}${f.params[i].sort === 'nat' ? f.params[i].name : `size(${f.params[i].name})`}`] : []));
+        const t = [...parts, ...(c.c ? [String(c.c)] : [])].join(' + ').replace(/\+ −/g, '− ');
+        return t || '0';
+    };
+    return m.comps.length === 1 ? comp(m.comps[0]) : `(${m.comps.map(comp).join(', ')})`;
+};
+// A component at arguments, as a term (its negative part subtracted, truncated as the encoding reads it).
+const sizeX = (s, a) => (s === 'nat' ? a : { op: 'size', data: s.name, of: a });
+export function measureX(f, c, args) {
+    const pos = [], neg = [];
+    c.coef.forEach((k, i) => { if (!k)
+        return; const t = sizeX(f.params[i].sort, args[i]); (k > 0 ? pos : neg).push(Math.abs(k) === 1 ? t : { op: 'mul', k: Math.abs(k), a: t }); });
+    if (c.c > 0)
+        pos.push({ op: 'nat', value: c.c });
+    if (c.c < 0)
+        neg.push({ op: 'nat', value: -c.c });
+    const sum = (ts) => (ts.length ? ts.reduce((a, b) => ({ op: 'add', a, b })) : { op: 'nat', value: 0 });
+    return neg.length ? { op: 'sub', a: sum(pos), b: sum(neg) } : sum(pos);
+}
+const lexY = (as, bs) => (as.length === 1 ? { op: '<', a: as[0], b: bs[0] } : { op: 'or', xs: [{ op: '<', a: as[0], b: bs[0] }, { op: 'and', xs: [{ op: '=', a: as[0], b: bs[0] }, lexY(as.slice(1), bs.slice(1))] }] });
+function callSites(fn) {
+    const out = [], yesX = { op: 'bool', c: yes.y };
+    const at = (sh, name) => { let t = sh.get(name); while (t && t.op === 'var' && sh.has(t.name))
+        t = sh.get(t.name); return t; };
+    const goY = (y, w) => {
+        switch (y.op) {
+            case '<':
+            case '<=':
+            case '=':
+            case 'i<':
+            case 'i<=':
+                goX(y.a, w);
+                goX(y.b, w);
+                return;
+            case 'and':
+            case 'or':
+                y.xs.forEach(z => goY(z, w));
+                return;
+            case 'not':
+                goY(y.x, w);
+                return;
+            case 'is':
+                goX(y.of, w);
+                return;
+            case 'holds':
+                goX(y.x, w);
+                return;
+        }
+    };
+    const goX = (x, w) => {
+        switch (x.op) {
+            case 'var':
+            case 'nat': return;
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod':
+            case 'iadd':
+            case 'isub':
+                goX(x.a, w);
+                goX(x.b, w);
+                return;
+            case 'mul':
+            case 'mod':
+            case 'div':
+            case 'imul':
+            case 'imod':
+            case 'idiv':
+            case 'ineg':
+            case 'ofnat':
+                goX(x.a, w);
+                return;
+            case 'int': return;
+            case 'apply':
+                goX(x.arg, w);
+                return;
+            case 'size':
+                goX(x.of, w);
+                return;
+            case 'bool':
+                goY(x.c, w);
+                return;
+            case 'ctor':
+                x.args.forEach(a => goX(a, w));
+                return;
+            case 'call':
+                x.args.forEach(a => goX(a, w));
+                if (x.fn === fn.name)
+                    out.push({ args: x.args, ...w });
+                return;
+            case 'if':
+                goY(x.c, w);
+                goX(x.then, { ...w, wrap: y => w.wrap({ op: 'or', xs: [{ op: 'not', x: x.c }, y] }) });
+                goX(x.else, { ...w, wrap: y => w.wrap({ op: 'or', xs: [x.c, y] }) });
+                return;
+            case 'match': {
+                goX(x.of, w);
+                const d = dataNamed(x.data), v = x.of.op === 'var' ? x.of.name : undefined, had = v ? at(w.shape, v) : undefined;
+                x.cases.forEach((c, j) => {
+                    if (v && had?.op === 'ctor') {
+                        // matched before on this path: the same case, its fields the ones bound then; another, never reached
+                        if (had.ctor === j)
+                            goX(c.body, { ...w, shape: new Map([...w.shape, ...c.binds.map((b, i) => [b, had.args[i]])]) });
+                        return;
+                    }
+                    if (v && !had) {
+                        const fields = c.binds.map((b, i) => ({ name: b, sort: fieldSort(d.ctors[j].fields[i]) }));
+                        goX(c.body, { wrap: w.wrap, shape: new Map([...w.shape, [v, { op: 'ctor', data: x.data, ctor: j, args: c.binds.map(b => ({ op: 'var', name: b })) }]]), vars: [...w.vars, ...fields] });
+                        return;
+                    }
+                    goX(c.body, { ...w, wrap: y => w.wrap({ op: 'holds', x: { op: 'match', data: x.data, of: x.of, cases: x.cases.map((c2, i) => ({ binds: c2.binds, body: i === j ? { op: 'bool', c: y } : yesX })) } }) });
+                });
+                return;
+            }
+            case 'natmatch': {
+                goX(x.of, w);
+                const v = x.of.op === 'var' ? x.of.name : undefined;
+                if (v && !at(w.shape, v)) {
+                    goX(x.zero, { ...w, shape: new Map([...w.shape, [v, { op: 'nat', value: 0 }]]) });
+                    goX(x.succ, { wrap: w.wrap, shape: new Map([...w.shape, [v, { op: 'add', a: { op: 'var', name: x.pred }, b: { op: 'nat', value: 1 } }]]), vars: [...w.vars, { name: x.pred, sort: 'nat' }] });
+                    return;
+                }
+                goX(x.zero, { ...w, wrap: y => w.wrap({ op: 'holds', x: { op: 'natmatch', of: x.of, zero: { op: 'bool', c: y }, pred: x.pred, succ: yesX } }) });
+                goX(x.succ, { ...w, wrap: y => w.wrap({ op: 'holds', x: { op: 'natmatch', of: x.of, zero: yesX, pred: x.pred, succ: { op: 'bool', c: y } } }) });
+                return;
+            }
+        }
+    };
+    goX(fn.body(), { wrap: y => y, shape: new Map(), vars: fn.params.map(q => ({ name: `${fn.name}.${q.name}`, sort: q.sort })) });
+    return out;
+}
+// The obligation of a call: under its path, the measure at its arguments below the measure at the parameters, a law over
+// the path's variables (the parameters not matched, the fields of the cases taken).
+function obligation(fn, m, s, i) {
+    const own = fn.params.map(q => ({ op: 'var', name: `${fn.name}.${q.name}` }));
+    const shaped = (t) => (Array.isArray(t) ? t.map(shaped) : t && typeof t === 'object' ? (t.op === 'var' && s.shape.has(t.name) ? shaped(s.shape.get(t.name)) : Object.fromEntries(Object.entries(t).map(([key, v]) => [key, shaped(v)]))) : t);
+    const holds = shaped(s.wrap(lexY(m.comps.map(c => measureX(fn, c, s.args)), m.comps.map(c => measureX(fn, c, own)))));
+    return { name: `${fn.name}'s call ${i + 1} lowers ${showMeasure(fn, m)}`, vars: s.vars.filter(v => !s.shape.has(v.name)), holds, params: [...new Set(paramsIn(holds))] };
+}
+// The calls the function's runs make, each from its parameters' sizes to its arguments' (random arguments, up to 2,000
+// calls a run: a run past that is cut, its calls kept).
+let tracing;
+function runEdges(fn) {
+    const rand = rng(17), edges = new Map();
+    const feat = (vs) => fn.params.map((p, i) => (p.sort === 'nat' ? vs[i] : p.sort instanceof Data ? sizeOf(p.sort, vs[i]) : 0));
+    const tables = new Map();
+    const params = new Proxy({}, { get: (_, key) => tables.get(key) ?? (tables.set(key, randomFn(rand)), tables.get(key)) });
+    for (let i = 0; i < 120 && edges.size < 400; i++) {
+        const vals = fn.params.map(p => randomValue(p.sort, rand, 1 + (i % 7)));
+        tracing = { fn: fn.name, stack: [], fuel: 2000, edge: (a, b) => { const e = { s: feat(a), t: feat(b) }; edges.set(JSON.stringify(e), e); } };
+        try {
+            evalX({ op: 'call', fn: fn.name, args: vals.map((_, j) => ({ op: 'var', name: `$a${j}` })) }, new Map(vals.map((v, j) => [`$a${j}`, v])), params);
+        }
+        catch { /* cut: its calls kept */ }
+        finally {
+            tracing = undefined;
+        }
+    }
+    return [...edges.values()];
+}
+const valueOf = (c, xs) => Math.max(0, c.coef.reduce((a, k, i) => a + k * xs[i], c.c));
+const lowers = (m, e) => {
+    for (const c of m.comps) {
+        const a = valueOf(c, e.t), b = valueOf(c, e.s);
+        if (a < b)
+            return true;
+        if (a > b)
+            return false;
+    }
+    return false;
+};
+function candidates(fn, edges) {
+    if (fn.stated)
+        return [fn.stated];
+    const ix = fn.params.flatMap((p, i) => (measurable(p.sort) ? [i] : [])), n = fn.params.length;
+    const one = (i) => ({ coef: fn.params.map((_, j) => (j === i ? 1 : 0)), c: 0 }), sum = (is) => ({ coef: fn.params.map((_, j) => (is.includes(j) ? 1 : 0)), c: 0 });
+    const out = ix.map(i => ({ comps: [one(i)] }));
+    for (const i of ix)
+        for (const j of ix)
+            if (i !== j)
+                out.push({ comps: [one(i), one(j)] });
+    for (const [a, i] of ix.entries())
+        for (const j of ix.slice(a + 1))
+            out.push({ comps: [sum([i, j])] });
+    if (ix.length <= 4)
+        for (const i of ix)
+            for (const j of ix)
+                for (const k of ix)
+                    if (i !== j && j !== k && i !== k)
+                        out.push({ comps: [one(i), one(j), one(k)] });
+    if (ix.length > 2)
+        out.push({ comps: [sum(ix)] });
+    // The LP's rank over the runs (coefficients and constants), where the runs give edges.
+    if (edges.length) {
+        const vars = ix.map(i => `p${i}`), env = (xs) => Object.fromEntries(ix.map(i => [`p${i}`, xs[i]]));
+        const r = ranksOfRuns(vars, edges.flatMap(e => [env(e.s), env(e.t)]), edges.map(e => ({ s: env(e.s), t: env(e.t) })));
+        if (!r.left && r.comps.length)
+            out.push({ comps: r.comps.map(c => ({ coef: Array.from({ length: n }, (_, j) => c.coef[`p${j}`] ?? 0), c: c.c })) });
+    }
+    return out;
+}
+// An obligation as one node of a cyclic proof (no use, no models): its conclusion, each definition it reads unfolded
+// once, the constructors' facts at the values built, the shape at each size it reads and at its variables of a
+// datatype, the congruences 16 random models' explanations use. The kernel checks it as any cyclic proof; undefined where it isn't proven.
+function directly(law, ms) {
+    const p = programOf([law]), fs = factsOf(p), concl = encY(p, law.holds, new Map());
+    varSorts = new Map(law.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : [])));
+    const until = clock() + ms;
+    const insts = instancesOf(p, fs, { roots: [concl], others: [], depth: 1, shapesAt: [...varSorts.keys()].map(ev), etaAt: [], models: modelsFor(p, law, 16, 3), until });
+    if (clock() > until)
+        return undefined;
+    const was = pairedKeys.skip;
+    pairedKeys.skip = true;
+    try {
+        const v = withDeadline(until, () => proveCyclic(fs.facts, [{ name: law.name, hyps: [], concl, rank: [k(0)], insts, uses: [] }]));
+        return v.proven && v.checked ? v : undefined;
+    }
+    finally {
+        pairedKeys.skip = was;
+    }
+}
+function termination(fn, why) {
+    return counted(dataRate, () => {
+        if (dataTrace)
+            console.error(`[data] termination of ${fn.name}`);
+        const t0 = performance.now(), sites = callSites(fn);
+        if (!fn.params.some(p => measurable(p.sort)))
+            throw new Error(`${why}, and it has no parameter a measure reads (a natural or a datatype value)`);
+        if (dataTrace)
+            console.error(`[data]   ${sites.length} calls`);
+        const edges = runEdges(fn), until = clock() + terminationMs.ms, tried = [], seen = new Set();
+        if (dataTrace)
+            console.error(`[data]   its runs: ${edges.length} calls at ${Math.round(performance.now() - t0)} ms`);
+        for (const m of candidates(fn, edges)) {
+            if (dataTrace)
+                console.error(`[data]   ${showMeasure(fn, m)} at ${Math.round(performance.now() - t0)} ms`);
+            if (clock() > until) {
+                tried.push('out of time');
+                break;
+            }
+            const text = showMeasure(fn, m), bad = edges.find(e => !lowers(m, e));
+            if (seen.has(text))
+                continue;
+            seen.add(text);
+            if (bad) {
+                if (fn.stated || !tried.length)
+                    tried.push(`${text}: a call of its runs doesn't lower it (from ${JSON.stringify(bad.s)} to ${JSON.stringify(bad.t)}, the parameters' sizes)`);
+                continue;
+            }
+            const obligations = [];
+            let failed;
+            for (const [i, site] of sites.entries()) {
+                const law = obligation(fn, m, site, i);
+                // A call nested in its own argument or condition: the obligation would read the function being taken.
+                if (programOf([law]).fns.some(g => g.name === fn.name))
+                    throw new Error(`${why}, and a call to itself is nested in the argument or the condition of another (nested recursion isn't taken)`);
+                // First one node, the definitions unfolded once (most calls lower the measure by their cases alone); else
+                // proveData: by induction where the obligation has a scheme (a call on a filter of the tail: the filter's own
+                // recursion), else, or then, the definitions unfolded alone.
+                const left = () => Math.max(1, until - clock()), cex = refute(law, 200);
+                if (cex) {
+                    failed = `${text}: its call ${i + 1} doesn't lower it at ${JSON.stringify(cex)}`;
+                    break;
+                }
+                const direct = directly(law, Math.min(2000, left()));
+                if (direct) {
+                    obligations.push({ law, proof: direct, lemmas: [] });
+                    continue;
+                }
+                const inductive = schemes(programOf([law]), law).length > 0;
+                // (no conjectured lemmas: their making isn't counted in the budget, and a call's decrease mostly needs none)
+                let v = proveData(law, inductive ? { ms: Math.min(12_000, left()), lemmas: false } : { induction: false, ms: Math.min(4000, left()) });
+                if (inductive && !(v.proven && v.checked) && !v.counterexample && clock() < until)
+                    v = proveData(law, { induction: false, ms: Math.min(4000, left()) });
+                if (!(v.proven && v.checked)) {
+                    failed = `${text}: its call ${i + 1} ${v.counterexample ? `doesn't lower it at ${JSON.stringify(v.counterexample)}` : 'not proven to lower it'}`;
+                    break;
+                }
+                obligations.push({ law, proof: v.proof, scheme: v.scheme, lemmas: v.lemmas });
+            }
+            if (!failed)
+                return { measure: m, text, obligations, ms: Math.round(performance.now() - t0) };
+            tried.push(failed);
+        }
+        throw new Error(`${why}, and no measure is proven to fall at every call${tried.length ? ` (${tried.slice(0, 3).join('; ')})` : ''}`);
+    });
+}
 export function law(name, vars, holds) {
     const vs = Object.entries(vars).map(([n, s]) => ({ name: n, sort: s }));
     const y = holds(Object.fromEntries(vs.map(v => [v.name, wrap(v.sort, { op: 'var', name: v.name })]))).y;
@@ -332,8 +700,20 @@ export function law(name, vars, holds) {
 }
 const fnOf = (name) => { const f = fns.get(name); if (!f)
     throw new Error(`no function ${name}`); return f; };
+// A function by its name, if one is defined (core/transfer.ts names its copies apart from every other).
+export const fnNamed = (name) => fns.get(name);
 const asNat = (v) => v;
-export function evalX(x, env, params) {
+// Evaluation within bounds: a natural past 2^53 (no longer exact) always throws EvalLimit, and within the search
+// (`evalBounds.on`: proveData, refute) so do calls nested past `depth` or past `calls` of one call's evaluation, which
+// recursive powers and factorials reach on small values. The sample that needs one is skipped (refute), the model's
+// read is unknown (the search).
+export class EvalLimit extends RangeError {
+}
+export const evalBounds = { on: false, depth: 1000, calls: 20_000 };
+let evalCalls = 0;
+const exact = (n) => { if (n > Number.MAX_SAFE_INTEGER)
+    throw new EvalLimit('past 2^53'); return n; };
+export function evalX(x, env, params, d = 0) {
     switch (x.op) {
         case 'var': {
             const v = env.get(x.name);
@@ -342,53 +722,92 @@ export function evalX(x, env, params) {
             return v;
         }
         case 'nat': return x.value;
-        case 'add': return asNat(evalX(x.a, env, params)) + asNat(evalX(x.b, env, params));
-        case 'sub': return Math.max(0, asNat(evalX(x.a, env, params)) - asNat(evalX(x.b, env, params)));
-        case 'min': return Math.min(asNat(evalX(x.a, env, params)), asNat(evalX(x.b, env, params)));
-        case 'max': return Math.max(asNat(evalX(x.a, env, params)), asNat(evalX(x.b, env, params)));
-        case 'mul': return x.k * asNat(evalX(x.a, env, params));
-        case 'if': return evalY(x.c, env, params) ? evalX(x.then, env, params) : evalX(x.else, env, params);
-        case 'bool': return evalY(x.c, env, params) ? 1 : 0;
-        case 'apply': return params[x.param](asNat(evalX(x.arg, env, params)));
-        case 'ctor': return { c: x.ctor, f: x.args.map(a => evalX(a, env, params)) };
+        case 'add': return exact(asNat(evalX(x.a, env, params, d)) + asNat(evalX(x.b, env, params, d)));
+        case 'sub': return Math.max(0, asNat(evalX(x.a, env, params, d)) - asNat(evalX(x.b, env, params, d)));
+        case 'min': return Math.min(asNat(evalX(x.a, env, params, d)), asNat(evalX(x.b, env, params, d)));
+        case 'max': return Math.max(asNat(evalX(x.a, env, params, d)), asNat(evalX(x.b, env, params, d)));
+        case 'mul': return exact(x.k * asNat(evalX(x.a, env, params, d)));
+        case 'prod': return exact(asNat(evalX(x.a, env, params, d)) * asNat(evalX(x.b, env, params, d)));
+        case 'mod': return asNat(evalX(x.a, env, params, d)) % x.k;
+        case 'div': return Math.floor(asNat(evalX(x.a, env, params, d)) / x.k);
+        case 'int': return x.value;
+        case 'iadd': return exact(asNat(evalX(x.a, env, params, d)) + asNat(evalX(x.b, env, params, d)));
+        case 'isub': return exact(asNat(evalX(x.a, env, params, d)) - asNat(evalX(x.b, env, params, d)));
+        case 'ineg': return -asNat(evalX(x.a, env, params, d));
+        case 'imul': return exact(x.k * asNat(evalX(x.a, env, params, d)));
+        case 'ofnat': return asNat(evalX(x.a, env, params, d));
+        case 'imod': return euclidMod(asNat(evalX(x.a, env, params, d)), x.k);
+        case 'idiv': {
+            const v = asNat(evalX(x.a, env, params, d));
+            return (v - euclidMod(v, x.k)) / x.k;
+        }
+        case 'if': return evalY(x.c, env, params, d) ? evalX(x.then, env, params, d) : evalX(x.else, env, params, d);
+        case 'bool': return evalY(x.c, env, params, d) ? 1 : 0;
+        case 'apply': return params[x.param](asNat(evalX(x.arg, env, params, d)));
+        case 'size': return sizeOf(dataNamed(x.data), evalX(x.of, env, params, d));
+        case 'ctor': return { c: x.ctor, f: x.args.map(a => evalX(a, env, params, d)) };
         case 'natmatch': {
-            const n = asNat(evalX(x.of, env, params));
+            const n = asNat(evalX(x.of, env, params, d));
             if (n === 0)
-                return evalX(x.zero, env, params);
+                return evalX(x.zero, env, params, d);
             const e2 = new Map(env);
             e2.set(x.pred, n - 1);
-            return evalX(x.succ, e2, params);
+            return evalX(x.succ, e2, params, d);
         }
         case 'match': {
-            const v = evalX(x.of, env, params), cs = x.cases[v.c];
+            const v = evalX(x.of, env, params, d), cs = x.cases[v.c];
             const e2 = new Map(env);
             cs.binds.forEach((b, i) => e2.set(b, v.f[i]));
-            return evalX(cs.body, e2, params);
+            return evalX(cs.body, e2, params, d);
         }
         case 'call': {
-            const f = fnOf(x.fn), body = f.body();
-            const e2 = new Map(f.params.map((p, i) => [`${f.name}.${p.name}`, evalX(x.args[i], env, params)]));
-            return evalX(body, e2, params);
+            const f = fnOf(x.fn), body = f.body(), vals = x.args.map(a => evalX(a, env, params, d));
+            const e2 = new Map(f.params.map((p, i) => [`${f.name}.${p.name}`, vals[i]]));
+            if (evalBounds.on) {
+                if (d === 0)
+                    evalCalls = 0;
+                if (d >= evalBounds.depth || ++evalCalls > evalBounds.calls)
+                    throw new EvalLimit(`${f.name}: past the evaluation's bounds`);
+            }
+            if (tracing?.fn !== f.name)
+                return evalX(body, e2, params, d + 1);
+            // A run of a function whose termination is being proven: each call recorded, the run cut past its fuel.
+            const t = tracing;
+            if (--t.fuel < 0)
+                throw new RangeError('out of fuel');
+            const top = t.stack.at(-1);
+            if (top)
+                t.edge(top, vals);
+            t.stack.push(vals);
+            try {
+                return evalX(body, e2, params, d + 1);
+            }
+            finally {
+                t.stack.pop();
+            }
         }
     }
 }
-export function evalY(y, env, params) {
+export function evalY(y, env, params, d = 0) {
     switch (y.op) {
-        case '<': return asNat(evalX(y.a, env, params)) < asNat(evalX(y.b, env, params));
-        case '<=': return asNat(evalX(y.a, env, params)) <= asNat(evalX(y.b, env, params));
-        case '=': return same(evalX(y.a, env, params), evalX(y.b, env, params));
-        case 'and': return y.xs.every(z => evalY(z, env, params));
-        case 'or': return y.xs.some(z => evalY(z, env, params));
-        case 'not': return !evalY(y.x, env, params);
-        case 'is': return evalX(y.of, env, params).c === y.ctor;
-        case 'holds': return evalX(y.x, env, params) === 1;
+        case '<': return asNat(evalX(y.a, env, params, d)) < asNat(evalX(y.b, env, params, d));
+        case '<=': return asNat(evalX(y.a, env, params, d)) <= asNat(evalX(y.b, env, params, d));
+        case 'i<': return asNat(evalX(y.a, env, params, d)) < asNat(evalX(y.b, env, params, d));
+        case 'i<=': return asNat(evalX(y.a, env, params, d)) <= asNat(evalX(y.b, env, params, d));
+        case '=': return same(evalX(y.a, env, params, d), evalX(y.b, env, params, d));
+        case 'and': return y.xs.every(z => evalY(z, env, params, d));
+        case 'or': return y.xs.some(z => evalY(z, env, params, d));
+        case 'not': return !evalY(y.x, env, params, d);
+        case 'is': return evalX(y.of, env, params, d).c === y.ctor;
+        case 'holds': return evalX(y.x, env, params, d) === 1;
     }
 }
+const euclidMod = (v, k) => ((v % k) + k) % k;
 const same = (a, b) => (typeof a === 'number' || typeof b === 'number' ? a === b : a.c === b.c && a.f.every((x, i) => same(x, b.f[i])));
 export const showValue = (d, v) => {
     if (typeof v === 'number')
         return String(v);
-    if (d === 'nat' || d === 'bool')
+    if (d === 'nat' || d === 'bool' || d === 'int')
         return JSON.stringify(v);
     const c = d.ctors[v.c];
     return c.fields.length ? `${c.name}(${c.fields.map((f, i) => showValue(fieldSort(f), v.f[i])).join(', ')})` : c.name;
@@ -399,6 +818,8 @@ export function randomValue(s, rand, size, natMax = 5) {
         return Math.floor(rand() * (natMax + 1));
     if (s === 'bool')
         return rand() < 0.5 ? 0 : 1;
+    if (s === 'int')
+        return Math.floor(rand() * (2 * natMax + 1)) - natMax;
     // The leaves: constructors of no field of the group, or (a datatype with none, a rose tree) those of least height.
     const base = s.ctors.filter(c => c.fields.every(f => !inGroup(s, f)));
     const leaves = base.length ? base : s.ctors.filter(c => s.ctorHeight(c) === s.height);
@@ -428,7 +849,7 @@ const yesC = leC(k(0), k(0));
 const pairE = (a, b) => { const s = { op: 'add', a, b }; return { op: 'add', a: { op: 'prod', a: s, b: s }, b }; };
 export const keyOf = (args) => args.slice(1).reduce(pairE, args[0]);
 // The arguments of a key built by keyOf (n of them), read back from its shape.
-function argsOf(key, n) {
+export function argsOf(key, n) {
     if (n === 1)
         return [key];
     if (key.op !== 'add' || key.a.op !== 'prod' || key.a.a.op !== 'add')
@@ -459,6 +880,11 @@ export function programOf(laws, extra = []) {
         }
         if (o.op === 'apply')
             ps.add(o.param);
+        if (o.op === 'size')
+            addSort(dataNamed(o.data));
+        // (a datatype read only through a constructor, a match or a test of one: a law with a definition unfolded)
+        if ((o.op === 'ctor' || o.op === 'match' || o.op === 'is') && typeof o.data === 'string')
+            addSort(dataNamed(o.data));
     });
     for (const l of laws) {
         l.vars.forEach(v => addSort(v.sort));
@@ -478,11 +904,92 @@ export function programOf(laws, extra = []) {
     // (the recursion of each checked)
     for (const f of order)
         void f.decreases;
-    return { datas, fns: order, params: [...ps] };
+    const divs = new Set();
+    let ints = false;
+    const scan = (t) => walk(t, o => { if (o.op === 'mod' || o.op === 'div' || o.op === 'imod' || o.op === 'idiv')
+        divs.add(o.k); if (typeof o.op === 'string' && (intOps.has(o.op) || o.op === 'i<' || o.op === 'i<='))
+        ints = true; });
+    for (const l of laws) {
+        scan(l.holds);
+        if (l.vars.some(v => v.sort === 'int'))
+            ints = true;
+    }
+    for (const f of order) {
+        scan(f.body());
+        if (f.ret === 'int' || f.params.some(q => q.sort === 'int'))
+            ints = true;
+    }
+    for (const d of datas)
+        if (d.ctors.some(c => c.fields.some(f => f.sort === 'int')))
+            ints = true;
+    if (ints)
+        divs.add(2);
+    return { datas, fns: order, params: [...ps], divisors: [...divs].sort((a, b) => a - b), ints };
 }
 const dataOf = (p, name) => p.datas.find(d => d.name === name);
+// Division and remainder by a constant: the maps div$k and mod$k (core/machine.ts names them so), known by Euclid's fact
+// at each key read (`arith k`).
+export const divMap = (k) => `div$${k}`, modMap = (k) => `mod$${k}`;
+const arithMap = /^(?:div|mod)\$(\d+)$/;
+// Integers by their zigzag code: a code c is the integer p − n, p and n its value's two parts as maps of the code
+// (int$pos, int$neg), known by one fact (`zcode`): c + c mod 2 = 2p + 2n, p = 0 where c is odd, n = 0 where it is even;
+// a pair (p, n) has the code 2(p ∸ n) + (2(n ∸ p) ∸ 1). Neither direction needs an if, so the kernel splits only where a
+// proof needs the sign or the parity.
+export const zig = (z) => (z >= 0 ? 2 * z : -2 * z - 1);
+export const unzig = (c) => (c % 2 === 0 ? c / 2 : -(c + 1) / 2);
+const sumE = (a, b) => (a.op === 'const' && a.value === 0 ? b : b.op === 'const' && b.value === 0 ? a : { op: 'add', a, b });
+export const posMap = 'int$pos', negMap = 'int$neg';
+const pairOfCode = (c) => {
+    if (c.op === 'const') {
+        const z = unzig(c.value);
+        return [k(Math.max(z, 0)), k(Math.max(-z, 0))];
+    }
+    return [get(posMap, c), get(negMap, c)];
+};
+const codeOfPair = ([pos, neg]) => {
+    if (neg.op === 'const' && neg.value === 0)
+        return { op: 'mul', k: 2, a: pos };
+    return { op: 'add', a: { op: 'mul', k: 2, a: { op: 'sub', a: pos, b: neg } }, b: { op: 'sub', a: { op: 'mul', k: 2, a: { op: 'sub', a: neg, b: pos } }, b: k(1) } };
+};
+const intOps = new Set(['int', 'iadd', 'isub', 'ineg', 'imul', 'ofnat', 'imod', 'idiv']);
+// An integer term as the two naturals p − n of its value.
+function encI(p, x, env) {
+    if (x.op === 'int')
+        return [k(Math.max(x.value, 0)), k(Math.max(-x.value, 0))];
+    if (x.op === 'iadd' || x.op === 'isub') {
+        const [a, b] = [encI(p, x.a, env), encI(p, x.b, env)];
+        return x.op === 'iadd' ? [sumE(a[0], b[0]), sumE(a[1], b[1])] : [sumE(a[0], b[1]), sumE(a[1], b[0])];
+    }
+    if (x.op === 'ineg') {
+        const [pos, neg] = encI(p, x.a, env);
+        return [neg, pos];
+    }
+    if (x.op === 'imul') {
+        const [pos, neg] = encI(p, x.a, env), m = Math.abs(x.k), sc = (e) => (m === 1 ? e : { op: 'mul', k: m, a: e });
+        return x.k >= 0 ? [sc(pos), sc(neg)] : [sc(neg), sc(pos)];
+    }
+    if (x.op === 'ofnat')
+        return [encX(p, x.a, env), k(0)];
+    // pos + (k − 1)·neg is the value plus k·neg: the same remainder, and the quotient plus neg.
+    if (x.op === 'imod' || x.op === 'idiv') {
+        const [pos, neg] = encI(p, x.a, env), t = x.k === 1 ? pos : sumE(pos, { op: 'mul', k: x.k - 1, a: neg });
+        return x.op === 'imod' ? [get(modMap(x.k), t), k(0)] : [get(divMap(x.k), t), neg];
+    }
+    return pairOfCode(encX(p, x, env));
+}
 export function encX(p, x, env) {
     switch (x.op) {
+        case 'prod': return { op: 'prod', a: encX(p, x.a, env), b: encX(p, x.b, env) };
+        case 'mod': return get(modMap(x.k), encX(p, x.a, env));
+        case 'div': return get(divMap(x.k), encX(p, x.a, env));
+        case 'int': return k(zig(x.value));
+        case 'iadd':
+        case 'isub':
+        case 'ineg':
+        case 'imul':
+        case 'ofnat':
+        case 'imod':
+        case 'idiv': return codeOfPair(encI(p, x, env));
         case 'var': return env.get(x.name) ?? ev(x.name);
         case 'nat': return k(x.value);
         case 'add':
@@ -493,6 +1000,7 @@ export function encX(p, x, env) {
         case 'if': return { op: 'if', c: encY(p, x.c, env), then: encX(p, x.then, env), else: encX(p, x.else, env) };
         case 'bool': return { op: 'if', c: encY(p, x.c, env), then: k(1), else: k(0) };
         case 'apply': return get(x.param, encX(p, x.arg, env));
+        case 'size': return get(sizeMap(x.data), encX(p, x.of, env));
         case 'call': return get(x.fn, keyOf(x.args.map(a => encX(p, a, env))));
         case 'ctor': {
             const d = dataOf(p, x.data);
@@ -512,9 +1020,20 @@ export function encX(p, x, env) {
 }
 export function encY(p, y, env) {
     switch (y.op) {
+        case 'i<':
+        case 'i<=': {
+            const [a, b] = [encI(p, y.a, env), encI(p, y.b, env)];
+            return { op: y.op === 'i<' ? '<' : '<=', a: sumE(a[0], b[1]), b: sumE(b[0], a[1]) };
+        }
+        // Two integers where one is arithmetic: equal values (the same as equal codes, without writing the sum's code).
+        case '=':
+            if (intOps.has(y.a.op) || intOps.has(y.b.op)) {
+                const [a, b] = [encI(p, y.a, env), encI(p, y.b, env)];
+                return { op: '=', a: sumE(a[0], b[1]), b: sumE(b[0], a[1]) };
+            }
+            return { op: '=', a: encX(p, y.a, env), b: encX(p, y.b, env) };
         case '<':
-        case '<=':
-        case '=': return { op: y.op, a: encX(p, y.a, env), b: encX(p, y.b, env) };
+        case '<=': return { op: y.op, a: encX(p, y.a, env), b: encX(p, y.b, env) };
         case 'and':
         case 'or': return { op: y.op, xs: y.xs.map(z => encY(p, z, env)) };
         case 'not': return { op: 'not', x: encY(p, y.x, env) };
@@ -552,6 +1071,18 @@ export function factsOf(p) {
         const body = encX(p, f.body(), new Map());
         put(`fn ${f.name}`, { name: '', keys, holds: andC(eqC(get(f.name, keyOf(keys.map(ev))), body), ...(f.ret === 'bool' ? [leC(get(f.name, keyOf(keys.map(ev))), k(1))] : [])) });
     }
+    // Euclid's division by each divisor: x = k·(x div k) + x mod k, x mod k < k.
+    for (const k2 of p.divisors) {
+        put(`arith ${k2}`, { name: '', keys: ['x$'], holds: andC(eqC(x, { op: 'add', a: { op: 'mul', k: k2, a: get(divMap(k2), x) }, b: get(modMap(k2), x) }), { op: '<', a: get(modMap(k2), x), b: k(k2) }) });
+        arity.set(divMap(k2), 1);
+        arity.set(modMap(k2), 1);
+    }
+    if (p.ints) {
+        const pos = get(posMap, x), neg = get(negMap, x), par = get(modMap(2), x);
+        put('zcode', { name: '', keys: ['x$'], holds: andC(eqC({ op: 'add', a: x, b: par }, { op: 'add', a: { op: 'mul', k: 2, a: pos }, b: { op: 'mul', k: 2, a: neg } }), { op: 'or', xs: [eqC(par, k(0)), eqC(pos, k(0))] }, { op: 'or', xs: [eqC(par, k(1)), eqC(neg, k(0))] }) });
+        arity.set(posMap, 1);
+        arity.set(negMap, 1);
+    }
     // Every map the encoding reads: the datatypes' tag, size and fields too (each of one argument).
     for (const d of p.datas) {
         arity.set(tagMap(d.name), 1);
@@ -584,14 +1115,14 @@ export function decode(d, n) {
     if (n < z)
         return { c: n, f: [] };
     const q = Math.floor((n - z) / m), j = z + ((n - z) % m), c = d.ctors[j];
-    return { c: j, f: c.fields.map((f, i) => { const x = tup(q, c.fields.length, i); return f.sort === 'nat' ? x : decode(dataNamed(f.sort.data), x); }) };
+    return { c: j, f: c.fields.map((f, i) => { const x = tup(q, c.fields.length, i); return f.sort === 'nat' ? x : f.sort === 'int' ? unzig(x) : decode(dataNamed(f.sort.data), x); }) };
 }
 export function encode(d, v) {
     const o = v, z = d.nullary, m = d.ctors.length - z;
     if (o.c < z)
         return o.c;
     const c = d.ctors[o.c];
-    return safe(z + m * tupk(c.fields.map((f, i) => (f.sort === 'nat' ? o.f[i] : encode(dataNamed(f.sort.data), o.f[i])))) + (o.c - z));
+    return safe(z + m * tupk(c.fields.map((f, i) => (f.sort === 'nat' ? o.f[i] : f.sort === 'int' ? zig(o.f[i]) : encode(dataNamed(f.sort.data), o.f[i])))) + (o.c - z));
 }
 // Each map of the encoding as a function of its arguments, on the codes (for core/cycles.ts's runs).
 export function codeValues(p) {
@@ -600,20 +1131,28 @@ export function codeValues(p) {
         out[tagMap(d.name)] = n => decode(d, n).c;
         out[sizeMap(d.name)] = n => sizeOf(d, decode(d, n));
         d.ctors.forEach((c, j) => {
-            c.fields.forEach((f, i) => { out[fieldMap(d, j, i)] = n => { const v = decode(d, n); return v.c === j ? (f.sort === 'nat' ? v.f[i] : encode(dataNamed(f.sort.data), v.f[i])) : 0; }; });
+            c.fields.forEach((f, i) => { out[fieldMap(d, j, i)] = n => { const v = decode(d, n); return v.c === j ? (f.sort === 'nat' ? v.f[i] : f.sort === 'int' ? zig(v.f[i]) : encode(dataNamed(f.sort.data), v.f[i])) : 0; }; });
             if (c.fields.length)
-                out[ctorMap(d, j)] = (...xs) => encode(d, { c: j, f: c.fields.map((f, i) => (f.sort === 'nat' ? xs[i] : decode(dataNamed(f.sort.data), xs[i]))) });
+                out[ctorMap(d, j)] = (...xs) => encode(d, { c: j, f: c.fields.map((f, i) => (f.sort === 'nat' ? xs[i] : f.sort === 'int' ? unzig(xs[i]) : decode(dataNamed(f.sort.data), xs[i]))) });
         });
     }
     for (const f of p.fns)
         out[f.name] = (...xs) => {
-            const v = evalX(f.body(), new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, q.sort instanceof Data ? decode(q.sort, xs[i]) : xs[i]])), {});
-            return f.ret instanceof Data ? encode(f.ret, v) : v;
+            const v = evalX(f.body(), new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, q.sort instanceof Data ? decode(q.sort, xs[i]) : q.sort === 'int' ? unzig(xs[i]) : xs[i]])), {});
+            return f.ret instanceof Data ? encode(f.ret, v) : f.ret === 'int' ? zig(v) : v;
         };
+    for (const k2 of p.divisors) {
+        out[divMap(k2)] = n => Math.floor(n / k2);
+        out[modMap(k2)] = n => n % k2;
+    }
+    if (p.ints) {
+        out[posMap] = n => Math.max(unzig(n), 0);
+        out[negMap] = n => Math.max(-unzig(n), 0);
+    }
     return out;
 }
 // That a value's fields of its datatype have smaller codes (true of the codes above: each field at most q).
-export const orderFacts = (p) => p.datas.map(d => ({ name: `order ${d.name}`, keys: ['x$'], holds: andC(yesC, ...d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort !== 'nat' && f.sort.data === d.name ? [implies(eqC(get(tagMap(d.name), ev('x$')), k(j)), { op: '<', a: get(fieldMap(d, j, i), ev('x$')), b: ev('x$') })] : [])))) }));
+export const orderFacts = (p) => p.datas.map(d => ({ name: `order ${d.name}`, keys: ['x$'], holds: andC(yesC, ...d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (isDataField(f.sort) && f.sort.data === d.name ? [implies(eqC(get(tagMap(d.name), ev('x$')), k(j)), { op: '<', a: get(fieldMap(d, j, i), ev('x$')), b: ev('x$') })] : [])))) }));
 // --- concrete models: a value of the encoding at random values (which terms are equal, for congruences and matches) ----
 // Values interned per datatype: a constructor of no field is its tag; the rest numbered from there. A key is a
 // pairing's natural, read back through its square root.
@@ -654,8 +1193,8 @@ export class Model {
         return v;
     }
     // A value of a sort as the encoding's natural, and back.
-    code(s, v) { return s instanceof Data ? this.id(s, v) : v; }
-    decode(s, n) { return s instanceof Data ? this.value(s, n) : n; }
+    code(s, v) { return s instanceof Data ? this.id(s, v) : s === 'int' ? zig(v) : v; }
+    decode(s, n) { return s instanceof Data ? this.value(s, n) : s === 'int' ? unzig(n) : n; }
     memo = new Map();
     read(map, key) {
         const at = `${map}|${key}`, had = this.memo.get(at);
@@ -690,8 +1229,17 @@ export class Model {
             const as = unkey(key, f.params.length);
             const env = new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, this.decode(q.sort, as[i])]));
             const out = evalX(f.body(), env, this.params);
-            return f.ret === 'nat' || f.ret === 'bool' ? out : this.id(f.ret, out);
+            return f.ret === 'nat' || f.ret === 'bool' ? out : f.ret === 'int' ? zig(out) : this.id(f.ret, out);
         }
+        const ar = arithMap.exec(map);
+        if (ar) {
+            const k2 = Number(ar[1]);
+            return map.startsWith('mod') ? key % k2 : Math.floor(key / k2);
+        }
+        if (map === posMap)
+            return Math.max(unzig(key), 0);
+        if (map === negMap)
+            return Math.max(-unzig(key), 0);
         const prm = this.params[map];
         if (prm)
             return prm(key);
@@ -751,20 +1299,31 @@ export function unkey(key, n) {
     return [...unkey(a, n - 1), b];
 }
 // Random values of the law's variables: a law false at one is refuted with it.
+// A sample whose evaluation passes the bounds (EvalLimit, or the stack) is skipped.
 export function refute(l, n = 400, seed = 7) {
-    for (const s of samples(l.vars, programOf([l]).params, n, seed)) {
-        let ok;
-        try {
-            ok = evalY(l.holds, s.env, s.params);
-        }
-        catch (e) {
-            throw new Error(`${l.name}: ${e.message}`);
+    return bounded(() => {
+        for (const s of samples(l.vars, programOf([l]).params, n, seed)) {
+            let ok;
+            try {
+                ok = evalY(l.holds, s.env, s.params);
+            }
+            catch (e) {
+                if (e instanceof RangeError)
+                    continue;
+                throw new Error(`${l.name}: ${e.message}`);
+            }
+            if (!ok)
+                return Object.fromEntries(l.vars.map(v => [v.name, showValue(v.sort, s.env.get(v.name))]));
         }
-        if (!ok)
-            return Object.fromEntries(l.vars.map(v => [v.name, showValue(v.sort, s.env.get(v.name))]));
-    }
-    return undefined;
+        return undefined;
+    });
 }
+const bounded = (f) => { const was = evalBounds.on; evalBounds.on = true; try {
+    return f();
+}
+finally {
+    evalBounds.on = was;
+} };
 // The function a function f calls at its decreasing argument's field of datatype `to` (a rose tree's sum, at its forest:
 // the forest's sum): the call, the same for every such field, its other arguments f's own parameters or closed terms.
 function partner(f, to) {
@@ -783,7 +1342,7 @@ function partner(f, to) {
         const t = x;
         if (t.op === 'match' && t.of.op === 'var' && t.of.name === own) {
             const d = dataNamed(t.data);
-            t.cases.forEach((c, j) => go(c.body, new Set([...fields, ...c.binds.filter((_, i) => { const fl = d.ctors[j].fields[i]; return fl.sort !== 'nat' && fl.sort.data === to.name; })])));
+            t.cases.forEach((c, j) => go(c.body, new Set([...fields, ...c.binds.filter((_, i) => { const fl = d.ctors[j].fields[i]; return isDataField(fl.sort) && fl.sort.data === to.name; })])));
             return;
         }
         if (t.op === 'call') {
@@ -883,6 +1442,31 @@ function mutualScheme(l, v, d) {
         ? [{ subst: { [at.get(f.sort.data).v]: get(fieldMap(x, j, i), ev(xv)) }, guard: eqC(get(tagMap(x.name), ev(xv)), k(j)), member: order.indexOf(f.sort.data) }] : [])));
     return { name: `mutual structure of ${v}`, on: { v, d }, uses: usesOf(d, v), companions: order.slice(1).map(n => { const x = dataNamed(n), a = at.get(n); return { law: a.law, on: { v: a.v, d: x }, uses: usesOf(x, a.v) }; }) };
 }
+// The width of a program's ranks' middle: its widest measure (1 when every recursion is structural).
+const rankWidth = (p) => Math.max(1, ...p.fns.map(f => (f.decreases === undefined ? f.measure?.comps.length ?? 1 : 1)));
+// Where a well-founded scheme's node wants a datatype's shape: at the values its measure reads, and at those its measure
+// reads at each use (a constructor's value a call passes: its size from its fields).
+function rankShapes(shapes, rank, uses) {
+    const out = new Map(shapes.map(e => [tid(e), e]));
+    walk(uses.map(u => rank.map(e => substE(e, { vars: u.subst, maps: {}, flags: {} }))), o => { if (o.op === 'get' && o.map.endsWith('.size'))
+        out.set(tid(o.key), o.key); });
+    return [...out.values()];
+}
+// The parameters a function's definition is decided at when they are a constructor's value: a structural one's
+// decreasing parameter (a datatype's), a well-founded one's parameters of a datatype its body matches on.
+function unfoldAt(f) {
+    if (f.decreases !== undefined)
+        return f.params[f.decreases].sort instanceof Data ? [f.decreases] : [];
+    if (!f.measure)
+        return [];
+    const out = new Set();
+    walk(f.body(), o => { if (o.op === 'match' && o.of.op === 'var') {
+        const i = f.params.findIndex(q => `${f.name}.${q.name}` === o.of.name);
+        if (i >= 0 && f.params[i].sort instanceof Data)
+            out.add(i);
+    } });
+    return [...out];
+}
 // The inductions the search tries for a law (its schemes), for tests.
 export const schemesOf = (p, l) => schemes(p, l);
 function schemes(p, l) {
@@ -898,12 +1482,13 @@ function schemes(p, l) {
             return;
         const f = fnOf(o.fn), args = o.args;
         f.body();
-        if (f.decreases === undefined)
+        const m = f.decreases === undefined ? f.measure : undefined;
+        if (f.decreases === undefined && !m)
             return;
-        const at = args[f.decreases];
-        if (at.op !== 'var' || !l.vars.some(v => v.name === at.name))
+        const at = args[f.decreases ?? 0];
+        if (!m && (at.op !== 'var' || !l.vars.some(v => v.name === at.name)))
             return;
-        const d = f.params[f.decreases].sort;
+        const d = f.params[f.decreases ?? 0].sort;
         const formal = new Map(f.params.map((q, i) => [`${f.name}.${q.name}`, args[i].op === 'var' && l.vars.some(v => v.name === args[i].name) ? ev(args[i].name) : undefined]));
         const uses = [];
         const go = (x, env, guard) => {
@@ -928,6 +1513,14 @@ function schemes(p, l) {
                 go(t.succ, e2, [...guard, { op: 'not', x: eqC(of, k(0)) }]);
                 return;
             }
+            // (a well-founded call's descent may need its if's condition: x − y below x where y ≤ x)
+            if (m && t.op === 'if') {
+                const c = encY(p, t.c, env);
+                go(t.c, env, guard);
+                go(t.then, env, [...guard, c]);
+                go(t.else, env, [...guard, { op: 'not', x: c }]);
+                return;
+            }
             if (t.op === 'call' && t.fn === f.name) {
                 const subst = {};
                 let ok = true;
@@ -949,8 +1542,16 @@ function schemes(p, l) {
         };
         const env = new Map([...formal].flatMap(([key, e]) => (e ? [[key, e]] : [])));
         go(f.body(), env, []);
-        if (uses.length)
+        if (!uses.length)
+            return;
+        if (!m) {
             add({ name: `recursion of ${f.name} on ${at.name}`, on: { v: at.name, d }, uses });
+            return;
+        }
+        // Well-founded: ranked by the measure at the law's arguments; the law's variables it reads named.
+        const read = f.params.flatMap((q, i) => (m.comps.some(c => c.coef[i]) && args[i].op === 'var' && l.vars.some(v => v.name === args[i].name) ? [{ i, v: args[i].name }] : []));
+        add({ name: `recursion of ${f.name} on ${read.map(r => r.v).join(', ') || 'its arguments'}`, uses, rank: m.comps.map(c => encX(p, measureX(f, c, args), new Map())),
+            shapes: read.filter(r => f.params[r.i].sort instanceof Data).map(r => ev(r.v)) });
     });
     // Structural induction on each variable of a datatype, the others fixed; mutual where its fields reach another of its
     // group (the law and its companions), plain where they reach none or no companion is found.
@@ -962,7 +1563,7 @@ function schemes(p, l) {
             out.push(mut);
             continue;
         }
-        add({ name: `structure of ${v.name}`, on: { v: v.name, d }, uses: d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (f.sort !== 'nat' && f.sort.data === d.name ? [{ subst: { [v.name]: get(fieldMap(d, j, i), x) }, guard: eqC(get(tagMap(d.name), x), k(j)) }] : []))) });
+        add({ name: `structure of ${v.name}`, on: { v: v.name, d }, uses: d.ctors.flatMap((c, j) => c.fields.flatMap((f, i) => (isDataField(f.sort) && f.sort.data === d.name ? [{ subst: { [v.name]: get(fieldMap(d, j, i), x) }, guard: eqC(get(tagMap(d.name), x), k(j)) }] : []))) });
     }
     return out;
 }
@@ -1024,10 +1625,27 @@ function instancesOf(p, fs, w) {
             inst(`fn ${f.name}`, as);
             const body = reads(holdsAt(`fn ${f.name}`, as));
             ctors(note(body));
-            next.push(...body);
+            for (const b of body)
+                next.push(b);
         }
         frontier = next;
     }
+    // Euclid's fact at every key a remainder or quotient is read at (a read the facts bring is read too).
+    const ariths = () => {
+        for (let pass = 0; pass < 2; pass++)
+            for (const r of [...all]) {
+                if (r.map === posMap || r.map === negMap) {
+                    inst('zcode', [r.key]);
+                    note(reads(holdsAt('zcode', [r.key])));
+                }
+                const m = arithMap.exec(r.map);
+                if (m) {
+                    inst(`arith ${m[1]}`, [r.key]);
+                    note(reads(holdsAt(`arith ${m[1]}`, [r.key])));
+                }
+            }
+    };
+    ariths();
     lap(`unfolded, ${insts.length} instances, ${all.length} reads`);
     const closure = (model) => {
         const parent = new Map(), terms = new Map(), adj = new Map();
@@ -1133,32 +1751,31 @@ function instancesOf(p, fs, w) {
             }
             for (const r of [...all]) {
                 const f = fnOfMap(r.map);
-                if (!f || f.decreases === undefined)
+                if (!f)
                     continue;
                 const as = argsOf(r.key, f.params.length);
                 if (!as)
                     continue;
-                const d0 = f.params[f.decreases].sort;
-                if (!(d0 instanceof Data))
-                    continue;
-                const own = as[f.decreases], d = d0, root = cl.find(tid(own));
-                const built = (t) => (t.op === 'get' && d.ctors.some((c, j) => c.fields.length && t.map === ctorMap(d, j))) || (t.op === 'const' && t.value < d.nullary);
-                const cands = built(own) ? [own] : [...cl.terms.values()].filter(t => built(t) && cl.find(tid(t)) === root);
-                for (const t of cands) {
-                    const as2 = as.map((a, i) => (i === f.decreases ? t : a)), rid = JSON.stringify({ map: f.name, key: keyOf(as2) }), key2 = JSON.stringify([fs.at.get(`fn ${f.name}`), as2]);
-                    const anchor = { read: tid(get(f.name, r.key)), arg: own, value: t }, had = anchoredAt.get(key2) ?? [];
-                    if (!had.some(x => x.read === anchor.read))
-                        anchoredAt.set(key2, [...had, anchor]);
-                    if (unfolded.has(rid) || extra >= 12 || done.has(sigOf(f.name, as2)))
-                        continue;
-                    unfolded.add(rid);
-                    extra++;
-                    done.add(sigOf(f.name, as2));
-                    if (dataTrace)
-                        console.error(`[data]     unfold ${f.name} at ${JSON.stringify(as2).slice(0, 160)} for ${JSON.stringify(r.key).slice(0, 80)}`);
-                    inst(`fn ${f.name}`, as2);
-                    note([{ map: f.name, key: keyOf(as2) }]);
-                    ctors(note(reads(holdsAt(`fn ${f.name}`, as2))));
+                for (const di of unfoldAt(f)) {
+                    const own = as[di], d = f.params[di].sort, root = cl.find(tid(own));
+                    const built = (t) => (t.op === 'get' && d.ctors.some((c, j) => c.fields.length && t.map === ctorMap(d, j))) || (t.op === 'const' && t.value < d.nullary);
+                    const cands = built(own) ? [own] : [...cl.terms.values()].filter(t => built(t) && cl.find(tid(t)) === root);
+                    for (const t of cands) {
+                        const as2 = as.map((a, i) => (i === di ? t : a)), rid = JSON.stringify({ map: f.name, key: keyOf(as2) }), key2 = JSON.stringify([fs.at.get(`fn ${f.name}`), as2]);
+                        const anchor = { read: tid(get(f.name, r.key)), arg: own, value: t }, had = anchoredAt.get(key2) ?? [];
+                        if (!had.some(x => x.read === anchor.read))
+                            anchoredAt.set(key2, [...had, anchor]);
+                        if (unfolded.has(rid) || extra >= 12 || done.has(sigOf(f.name, as2)))
+                            continue;
+                        unfolded.add(rid);
+                        extra++;
+                        done.add(sigOf(f.name, as2));
+                        if (dataTrace)
+                            console.error(`[data]     unfold ${f.name} at ${JSON.stringify(as2).slice(0, 160)} for ${JSON.stringify(r.key).slice(0, 80)}`);
+                        inst(`fn ${f.name}`, as2);
+                        note([{ map: f.name, key: keyOf(as2) }]);
+                        ctors(note(reads(holdsAt(`fn ${f.name}`, as2))));
+                    }
                 }
             }
         }
@@ -1177,7 +1794,7 @@ function instancesOf(p, fs, w) {
                     if (c.fields.length && t.map === ctorMap(d, j))
                         return d;
                     for (const [i, fl] of c.fields.entries())
-                        if (fl.sort !== 'nat' && t.map === fieldMap(d, j, i))
+                        if (isDataField(fl.sort) && t.map === fieldMap(d, j, i))
                             return dataNamed(fl.sort.data);
                 }
         }
@@ -1189,6 +1806,12 @@ function instancesOf(p, fs, w) {
     } };
     for (const t of w.shapesAt)
         shape(t, typeOfVar(p, t));
+    // A size the goal reads (a measure's, in a well-founded call's obligation): the shape of its value, which gives the
+    // size from the fields.
+    for (const r of reads([w.roots, w.others]))
+        for (const d of p.datas)
+            if (r.map === sizeMap(d.name))
+                shape(r.key, d);
     if (w.depth >= 2)
         for (const r of [...all])
             for (const d of p.datas)
@@ -1345,6 +1968,9 @@ function instancesOf(p, fs, w) {
     for (const d of used.values())
         if (!w.every || d.n >= w.models.length)
             inst(`cong ${d.map}`, d.at);
+    for (const q of [...insts])
+        note(reads(holdsAt(fs.facts[q.fact].name, q.at)));
+    ariths();
     lap(`congruences, ${insts.length} instances, ${w.models.length} models`);
     return insts;
 }
@@ -1482,7 +2108,7 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
     }
     // The scheme's nodes: the law's, then each companion's (a mutual induction), each its own models. A use of member i
     // reads node -1 - i until the nodes are placed.
-    const members = [{ law: l, on: scheme?.on, uses: scheme?.uses ?? [], pool }, ...(scheme?.companions ?? []).map(c => ({ ...c, pool: modelsFor(p, c.law, pool.length, 5) }))];
+    const members = [{ law: l, on: scheme?.on, uses: scheme?.uses ?? [], pool, rank: scheme?.rank, shapes: scheme?.shapes }, ...(scheme?.companions ?? []).map(c => ({ ...c, pool: modelsFor(p, c.law, pool.length, 5) }))];
     const concls = members.map(mb => encY(p, mb.law.holds, new Map()));
     const base = specs.length, title = `${l.name}${scheme ? ` (${scheme.name})` : ''}`;
     varSorts = new Map(members.flatMap(mb => mb.law.vars.flatMap(v => (v.sort instanceof Data ? [[v.name, v.sort]] : []))));
@@ -1492,7 +2118,7 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
     for (const [mi, mb] of members.entries()) {
         const models = mb.pool.slice(0, 24), concl = concls[mi], name = mi === 0 ? title : `${title}, at ${mb.on.d.name}`;
         const ih = mb.uses.map(u => ({ node: -1 - (u.member ?? mi), subst: u.subst, guard: u.guard }));
-        const shapesAt = mb.on && mb.on.d !== 'nat' ? [ev(mb.on.v)] : [];
+        const shapesAt = mb.rank ? rankShapes(mb.shapes ?? [], mb.rank, mb.uses) : mb.on && mb.on.d !== 'nat' ? [ev(mb.on.v)] : [];
         const ihConcls = ih.map(useConcl);
         // Uses of the lemmas, where a lemma's largest read matches a read of this goal (unfolded), its key up to the
         // equalities the unfolded definitions give (any branch); twice over, the uses' own conclusions read the second time.
@@ -1538,8 +2164,10 @@ function attempt(p, fs, l, scheme, depth, lemmas, level, pool) {
     const offsets = plans.map((_, i) => base + plans.slice(0, i).reduce((n, q) => n + q.length, 0));
     for (const [mi, plan] of plans.entries()) {
         const mb = members[mi], size = !mb.on ? k(0) : mb.on.d === 'nat' ? ev(mb.on.v) : get(sizeMap(mb.on.d.name), ev(mb.on.v));
+        // (level, the measure or the size, 0 or 1), the measure's place padded to the program's widest measure
+        const comps = mb.rank ?? [size], mid = [...comps, ...Array.from({ length: rankWidth(p) - comps.length }, () => k(0))];
         for (const { sub, cases, ...n } of plan)
-            specs.push({ ...n, rank: [k(level), size, k(sub)], uses: cases ? cases.map((g, i) => ({ node: offsets[mi] + 1 + i, subst: {}, guard: g })) : n.uses.map(u => (u.node < 0 ? { ...u, node: offsets[-1 - u.node] } : u)) });
+            specs.push({ ...n, rank: [k(level), ...mid, k(sub)], uses: cases ? cases.map((g, i) => ({ node: offsets[mi] + 1 + i, subst: {}, guard: g })) : n.uses.map(u => (u.node < 0 ? { ...u, node: offsets[-1 - u.node] } : u)) });
     }
     const name = title;
     // Each attempt within its own time (a goal past it is left unknown, and the attempt fails).
@@ -1613,6 +2241,12 @@ function reached(p, fs, insts, from, ms) {
             return [get(name.slice(3), keyOf(q.at))];
         if (name.startsWith('ctor '))
             return [get(name.slice(5), keyOf(q.at))];
+        if (name.startsWith('arith ')) {
+            const k2 = Number(name.slice(6));
+            return [get(divMap(k2), q.at[0]), get(modMap(k2), q.at[0])];
+        }
+        if (name === 'zcode')
+            return [get(posMap, q.at[0]), get(negMap, q.at[0])];
         if (name.startsWith('shape ') || name.startsWith('eta ')) {
             const d = name.split(' ')[1];
             return [get(tagMap(d), q.at[0]), get(sizeMap(d), q.at[0]), ...p.datas.filter(x => x.name === d).flatMap(x => x.ctors.flatMap((c, j) => c.fields.map((_, i) => get(fieldMap(x, j, i), q.at[0]))))];
@@ -1817,10 +2451,14 @@ function modelsFor(p, l, n, seed) {
     });
 }
 // Prove a law with the lemmas given (each proven, with its nodes), trying each scheme at each depth.
-function proveWith(p, fs, l, lemmas, level, opts, until, per, depths) {
+// `without`: 'plain', the law with no induction where no scheme applies; 'cases', no induction, then by the cases of
+// each variable (a natural's zero and successor, a datatype's constructors), none of them using the law again.
+function proveWith(p, fs, l, lemmas, level, opts, until, per, depths, without) {
     const models = modelsFor(p, l, 240, opts.seed ?? 3);
     let tried = 0, last;
-    const ss = opts.induction === false ? [undefined] : schemes(p, l);
+    const cases = l.vars.flatMap((v) => (v.sort === 'nat' || v.sort instanceof Data ? [{ name: `cases of ${v.name}`, on: { v: v.name, d: v.sort }, uses: [] }] : []));
+    const found = opts.induction === false || without === 'cases' ? [] : schemes(p, l);
+    const ss = opts.induction === false ? [undefined] : without === 'cases' ? [undefined, ...cases] : without === 'plain' && !found.length ? [undefined] : found;
     for (const depth of depths.filter(d => d <= (opts.depth ?? 3)))
         for (const s of ss) {
             if (clock() > until)
@@ -1829,7 +2467,7 @@ function proveWith(p, fs, l, lemmas, level, opts, until, per, depths) {
             const { verdict, specs, main } = (attemptMs.ms = Math.min(per * (opts.patience ?? 1), until - clock()), attempt(p, fs, l, s, depth, lemmas, level, models));
             last = verdict;
             if (verdict.proven && verdict.checked)
-                return { out: { law: l, spec: specs[main], nodes: specs }, verdict, scheme: s?.name, tried };
+                return { out: { law: l, spec: specs[main], nodes: specs }, verdict, scheme: s?.name ?? (without ? 'no induction' : undefined), tried };
         }
     return { tried, last };
 }
@@ -2005,8 +2643,10 @@ export function conjectures(p, l, max = 24, maxSize = 6) {
     const kept = [];
     // The definitions, unfolded at a constructor: f(.., C(x, y), ..) → its case's body, where that is a plain term.
     for (const f of fnsUsed) {
-        const body = f.body(), di = f.decreases;
-        if (body.op !== 'match' || di === undefined || body.of.op !== 'var' || body.of.name !== `${f.name}.${f.params[di].name}`)
+        // (a structural function's decreasing parameter, a well-founded one's the body matches on first)
+        const body = f.body(), top = body.op === 'match' && body.of.op === 'var' ? f.params.findIndex(q => `${f.name}.${q.name}` === body.of.name) : -1;
+        const di = f.decreases ?? (f.measure ? top : -1);
+        if (body.op !== 'match' || di < 0 || di !== top)
             continue;
         const d = f.params[di].sort;
         body.cases.forEach((c, j) => {
@@ -2109,9 +2749,21 @@ export const showX = (x) => {
         case 'min':
         case 'max': return `${x.op}(${showX(x.a)}, ${showX(x.b)})`;
         case 'mul': return `${x.k}·${showX(x.a)}`;
+        case 'prod': return `${showX(x.a)}·${showX(x.b)}`;
+        case 'mod':
+        case 'imod': return `${showX(x.a)} mod ${x.k}`;
+        case 'div':
+        case 'idiv': return `${showX(x.a)} div ${x.k}`;
+        case 'int': return String(x.value);
+        case 'iadd': return `${showX(x.a)} + ${showX(x.b)}`;
+        case 'isub': return `${showX(x.a)} − ${showX(x.b)}`;
+        case 'ineg': return `−${showX(x.a)}`;
+        case 'imul': return `${x.k}·${showX(x.a)}`;
+        case 'ofnat': return showX(x.a);
         case 'if': return `if ${showY(x.c)} then ${showX(x.then)} else ${showX(x.else)}`;
         case 'bool': return showY(x.c);
         case 'apply': return `${x.param}(${showX(x.arg)})`;
+        case 'size': return `size(${showX(x.of)})`;
         case 'call': return `${x.fn}(${x.args.map(showX).join(', ')})`;
         case 'ctor': {
             const d = [...fns.values()].length >= 0 ? x.data : x.data;
@@ -2126,6 +2778,8 @@ export const showY = (y) => {
         case '<':
         case '<=':
         case '=': return `${showX(y.a)} ${y.op} ${showX(y.b)}`;
+        case 'i<':
+        case 'i<=': return `${showX(y.a)} ${y.op.slice(1)} ${showX(y.b)}`;
         case 'and': return y.xs.map(showY).join(' and ');
         case 'or': return y.xs.map(showY).join(' or ');
         case 'not': return `not (${showY(y.x)})`;
@@ -2136,21 +2790,49 @@ export const showY = (y) => {
 // Prove a law over datatypes: refuted by a random value where one breaks it; else proven by a cycle the search finds,
 // with lemmas found from the values when the law alone isn't (`lemmas: false` turns that off; an array gives lemmas to
 // prove and use instead, which the corpus never does).
-export function proveData(l, opts = {}) { return counted(dataRate, () => proveDataCounted(l, opts)); }
+export function proveData(l, opts = {}) { return counted(dataRate, () => bounded(() => proveDataCounted(l, opts))); }
 function proveDataCounted(l, opts) {
-    const t0 = performance.now(), w0 = work.n, until = clock() + (opts.ms ?? 120_000);
-    const p = programOf([l, ...(Array.isArray(opts.lemmas) ? opts.lemmas : [])]), fs = factsOf(p);
+    const t0 = performance.now(), until = clock() + (opts.ms ?? 120_000);
+    // Where the law calls a non-recursive function, or reaches a recursive one that agrees with a built-in (core/transfer.ts):
+    // the law alone at one unfolding first, then the law said through them, then the rest of the search on the law.
+    const plan = opts.transfer === false || opts.induction === false || Array.isArray(opts.lemmas) ? undefined : transferPlan(l);
+    if (!plan)
+        return searchIn(l, opts, until).verdict;
+    const quick = searchIn(l, opts, until, undefined, 'first').verdict;
+    if (quick.proven || quick.counterexample)
+        return quick;
+    // (a law said through its definitions past what the encoding's terms take is left as stated)
+    let through;
+    try {
+        through = proveThrough(l, plan, opts, until);
+    }
+    catch (e) {
+        if (!(e instanceof RangeError))
+            throw e;
+    }
+    if (through?.proven)
+        return { ...through, ms: Math.round(performance.now() - t0) };
+    const rest = searchIn(l, opts, until, undefined, 'rest').verdict;
+    return { ...rest, tried: rest.tried + quick.tried + (through?.tried ?? 0), ms: Math.round(performance.now() - t0), ...(rest.goal || rest.proven ? {} : { goal: quick.goal, stuck: quick.stuck }) };
+}
+export function searchIn(l, opts, until, ctx, phase = 'all') {
+    const t0 = performance.now(), w0 = work.n;
+    const p = ctx?.p ?? programOf([l, ...(Array.isArray(opts.lemmas) ? opts.lemmas : [])]), fs = ctx?.fs ?? factsOf(p);
+    const base = ctx?.base ?? [], lv = ctx?.level ?? 0;
+    let out;
     const done = (v) => {
         if (dataTrace)
             console.error(`[data] ${l.name}: ${work.n - w0} units of work in ${Math.round(performance.now() - t0)} ms`);
-        return { law: l.name, ...v, ms: Math.round(performance.now() - t0) };
+        return { verdict: { law: l.name, ...v, ms: Math.round(performance.now() - t0) }, out };
     };
-    const cex = refute(l, opts.samples ?? 400);
-    if (cex)
-        return done({ proven: false, checked: false, counterexample: cex, lemmas: [], tried: 0 });
+    if (phase !== 'rest') {
+        const cex = refute(l, opts.samples ?? 400);
+        if (cex)
+            return done({ proven: false, checked: false, counterexample: cex, lemmas: [], tried: 0 });
+    }
     // The law alone at one unfolding; then lemmas at one unfolding each (the law tried again after each its goal
-    // matches); then the law at two; then lemmas at two; last the law at three. A lemma is named in the verdict when the
-    // proof uses it.
+    // matches); then the law at two; then lemmas at two; last the law at three, and without induction (by cases). A lemma
+    // is named in the verdict when the proof uses it.
     let tried = 0;
     const used = (r, lemmas) => {
         const nodes = r.nodes, seen = new Set(), todo = [nodes.indexOf(r.spec)];
@@ -2164,38 +2846,49 @@ function proveDataCounted(l, opts) {
         }
         return lemmas.filter(q => seen.has(nodes.indexOf(nodes.find(n => n.name === q.spec.name)))).map(q => q.law.name);
     };
-    const ok = (r, lemmas, prog = p) => (tried += r.tried, r.out ? done({ proven: true, checked: true, proof: r.verdict, lemmas: used(r.out, lemmas), scheme: r.scheme, tried, program: prog, node: r.out.nodes.indexOf(r.out.spec) }) : undefined);
-    const first = proveWith(p, fs, l, [], 1, opts, until, 6000, [1]);
-    const one = ok(first, []);
+    const ok = (r, lemmas, prog = p) => (tried += r.tried, r.out ? (out = r.out, done({ proven: true, checked: true, proof: r.verdict, lemmas: used(r.out, lemmas), scheme: r.scheme, tried, program: prog, node: r.out.nodes.indexOf(r.out.spec) })) : undefined);
+    // A law that calls no function (arithmetic alone: an integer's, a remainder's) has nothing to induct on: its cases.
+    if (phase !== 'rest' && opts.induction !== false && !JSON.stringify(l.holds).includes('"op":"call"')) {
+        const c = ok(proveWith(p, fs, l, base, lv + 1, opts, until, 3000, [1, 2], 'cases'), base);
+        if (c)
+            return c;
+    }
+    const first = phase === 'rest' ? undefined : proveWith(p, fs, l, base, lv + 1, opts, until, 6000, [1], 'plain');
+    const one = first && ok(first, base);
     if (one)
         return one;
+    if (phase === 'first')
+        return done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
     const without = opts.lemmas === false || opts.induction === false;
     if (without)
-        return ok(proveWith(p, fs, l, [], 1, opts, until, 20000, [2, 3]), []) ?? done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
+        return ok(proveWith(p, fs, l, base, lv + 1, opts, until, 20000, [2, 3]), base) ?? (opts.induction === false ? undefined : ok(proveWith(p, fs, l, base, lv + 1, opts, until, 3000, [1, 2], 'cases'), base)) ?? done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first?.last) });
     const cands = Array.isArray(opts.lemmas) ? opts.lemmas : conjectures(p, l);
-    const p2 = programOf([l, ...cands]), fs2 = factsOf(p2);
+    const p2 = ctx ? p : programOf([l, ...cands]), fs2 = ctx ? fs : factsOf(p2);
     // Each scheme's goals: the law's, and each companion's (a lemma may be what only a companion's goal reads).
-    const goalOf = (law, uses, on, concls) => {
+    const goalOf = (law, uses, on, concls, shapes) => {
         const concl = encY(p2, law.holds, new Map()), ihc = uses.map(u => substC(concls[u.member ?? 0] ?? concl, { vars: u.subst, maps: {}, flags: {} }));
-        return { from: [concl, ihc], insts: instancesOf(p2, fs2, { roots: [concl], others: ihc, depth: 2, shapesAt: on && on.d !== 'nat' ? [ev(on.v)] : [], etaAt: [], models: [] }) };
+        return { from: [concl, ihc], insts: instancesOf(p2, fs2, { roots: [concl], others: ihc, depth: 2, shapesAt: shapes ?? (on && on.d !== 'nat' ? [ev(on.v)] : []), etaAt: [], models: [] }) };
     };
     const goals = schemes(p2, l).flatMap(s => {
-        const all = [{ law: l, uses: s.uses, on: s.on }, ...(s.companions ?? [])], concls = all.map(m => encY(p2, m.law.holds, new Map()));
-        return all.map((m, i) => goalOf(m.law, m.uses.map(u => ({ ...u, member: u.member ?? i })), m.on, concls));
+        const all = [{ law: l, uses: s.uses, on: s.on, shapes: s.shapes }, ...(s.companions ?? [])], concls = all.map(m => encY(p2, m.law.holds, new Map()));
+        return all.map((m, i) => goalOf(m.law, m.uses.map(u => ({ ...u, member: u.member ?? i })), m.on, concls, 'shapes' in m ? m.shapes : undefined));
     });
     const matchesGoal = (c) => goals.some(g => lemmaUsesFor(p2, fs2, [{ law: c, node: 0, concl: encY(p2, c.holds, new Map()) }], g.from, g.insts).length > 0);
     // Those the goal matches first, of those the ones of the law's shape (an implication for an implication) first.
     const implication = (y) => y.op === 'or' && y.xs.length === 2 && y.xs[0].op === 'not';
     const score = (c, hit) => (hit ? 2 : 0) + (implication(c.holds) === implication(l.holds) ? 1 : 0);
+    if (dataTrace)
+        console.error(`[data] ${l.name}: ${cands.length} conjectures at ${Math.round(clock())} of ${Math.round(until)}`);
     const ranked = cands.map(c => ({ c, hit: matchesGoal(c) })).sort((a, b) => score(b.c, b.hit) - score(a.c, a.hit));
-    const proven = [], failed = new Set();
+    // The lemmas proven: those given (`base`) and those found, each found one a level above the last.
+    const proven = [...base], failed = new Set(), level = () => lv + 1 + proven.length - base.length;
     const lemmasAt = (depth) => {
         for (const { c, hit } of ranked) {
             if (clock() > until)
                 return undefined;
             if (proven.some(q => q.law === c) || (depth === 2 && !failed.has(c)) || refute(c, 200))
                 continue;
-            const r = proveWith(p2, fs2, c, proven, 1 + proven.length, opts, Math.min(until, clock() + (depth === 1 ? 8000 : 12000) * (opts.patience ?? 1)), 5000, [depth]);
+            const r = proveWith(p2, fs2, c, proven, level(), opts, Math.min(until, clock() + (depth === 1 ? 8000 : 12000) * (opts.patience ?? 1)), 5000, [depth]);
             tried += r.tried;
             if (!r.out) {
                 failed.add(c);
@@ -2205,7 +2898,7 @@ function proveDataCounted(l, opts) {
             proven.push(r.out);
             if (!hit && implication(c.holds) !== implication(l.holds))
                 continue;
-            const again = ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 6000, depth === 1 ? [1] : [1, 2]), proven, p2);
+            const again = ok(proveWith(p2, fs2, l, proven, level(), opts, until, 6000, depth === 1 ? [1] : [1, 2]), proven, p2);
             if (again)
                 return again;
         }
@@ -2213,19 +2906,23 @@ function proveDataCounted(l, opts) {
     };
     const steps = [
         () => lemmasAt(1),
-        () => ok(proveWith(p, fs, l, [], 1, opts, until, 30000, [2]), []),
-        () => (proven.length ? ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 30000, [2]), proven, p2) : undefined),
+        () => ok(proveWith(p, fs, l, base, lv + 1, opts, until, 30000, [2]), base),
+        () => (proven.length > base.length ? ok(proveWith(p2, fs2, l, proven, level(), opts, until, 30000, [2]), proven, p2) : undefined),
         () => lemmasAt(2),
-        () => ok(proveWith(p2, fs2, l, proven, 1 + proven.length, opts, until, 12000, [3]), proven, p2),
+        () => ok(proveWith(p2, fs2, l, proven, level(), opts, until, 12000, [3]), proven, p2),
+        // No induction: the law by the cases of a variable (or none), its definitions unfolded.
+        () => ok(proveWith(p, fs, l, base, lv + 1, opts, until, 3000, [1, 2], 'cases'), base),
     ];
-    for (const step of steps) {
+    for (const [i, step] of steps.entries()) {
         if (clock() > until)
             break;
-        const out = step();
-        if (out)
-            return out;
+        if (dataTrace)
+            console.error(`[data] ${l.name}: step ${i} at ${Math.round(clock())} of ${Math.round(until)}`);
+        const r = step();
+        if (r)
+            return r;
     }
-    return done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first.last) });
+    return done({ proven: false, checked: false, lemmas: [], tried, ...stuckOf(first?.last) });
 }
 const stuckOf = (v) => (v && !v.proven ? { goal: v.goal, stuck: v.stuck } : v && !v.checked ? { goal: 'check', stuck: v.why } : {});
 // The law with no cycle: its definitions unfolded, the kernel's prover alone (what the library proves without the search).